Nishi Family › Compare › NishiLang and Compiler Toolchain

Nishi Compare · capabilities, evidence and delivery

NishiLang and Compiler Toolchain

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi vs Rust and Zig and Go and Elm

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. NishiLang is a real self-hosted systems language: sovereign compiler (exceed: the whole chain bits-up), generics, sum types with exhaustiveness, two native backends, wasm, arity and type checks, caret and did-you-mean diagnostics, DWARF .debug_line, bounds-checked typed arrays, a gate-proven equality-saturation engine, and a compiler self-healing loop no peer carries in-repo; the no-float integer-determinism doctrine is proven at LLM scale (exceed). Not yet a peer of Rust, Zig, Go or Elm on what the public bug dumps say matters: raw-pointer provenance, ownership and use-after-free, checked arithmetic, option enforcement, data-race typing, closures, qualified imports, free multi-line expressions, working f64, the backend consuming its register allocation, eqsat consumed by a backend, an LSP, a formatter, incremental builds, a stepping debugger.

Where we need to go. OPERATOR STANDING ORDER 2026-09-22: NishiLang is to be SUPERIOR to Rust, gcc and every other language (and, operator 2026-09-22 second order: it is designed from the first bit up to build NishiOS and the Nishi browser, superior on every platform from a sensor to a supercomputer, forward-capable of quantum, photonic and other new substrates as DOORS on one source rather than rewrites, and scalable to the estate's own electronics from the CPU and GPU up when the resources arrive -- every language axis below is graded against that purpose, not against a benchmark alone), decided per axis by the scorecard's own measurement against the rival version named this month, never by a claim; the word superior is not written on any page until every rival axis reads WIN. The road there is the safety rungs the language can enforce (CWE-787 125 416 190 476 362 classes), a backend that uses the registers it already allocates, eqsat rewriting real IR behind the equivalence net, and the tooling ring every peer ships -- each bite-proven and promoted only after nx_cc_equiv_gate 10/10 plus self-host stays GREEN.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: arity checks, match exhaustiveness, diagnostics and .debug_line each landed in one leg (2026-08-05 to 08-07); estimates are relative to those.

Where we are: 23 open rungs. Language core and self-healing loop real; safety enforcement and tooling ring behind. Counts measured at emit below this line.

Cost to the cheapest safety wins: 3.5 u. LN1 checked overflow (first rung already shipped for constant shifts), LN2 option enforcement, LN3 pointer provenance -- the top of the CISA roadmap.

Cost to the memory-safety core: 6 u. LN4 ownership moves, LN5 use-after-free, LN6 Send-Sync typing -- the Rust axis, staged last in this tier because each needs the type system rungs below it.

Cost to a faster backend: 3.5 u. LN7 the x86 emitter consuming its allocation (witness-backed diagnosis), LN8 eqsat rewriting IR through the pass behind the equivalence net.

Cost to the tooling ring and language ergonomics: 9.5 u. LN9 formatter (cheapest, the tokenizer already yields the stream), LN10 incremental build cache (the key is solved), LN11 LSP, LN12 stepping debugger, LN13 closures, LN14 qualified imports, LN15 free multi-line expressions, LN16 working f64.

Cost to the research-admitted ring (2026-08-19 four-lane sweep): 16 u. LR1 enforced error model, LR2 structured concurrency, LR3 supply-chain measurement, LR4 capability security, LR5 written spec, LR6 OS-browser inheritance attestation, LR7 sound bounds-check elision -- the complaint classes the sweep says cannot be retrofitted later.

Research bar. Rust 1.97 is measured on borrow checker, rust-analyzer, rustfmt, incremental compilation. Theirs: the safety and tooling bar. Ours: LN3-LN6 LN9-LN11 measured on this page.

Research bar. Zig 0.15 is measured on runtime safety modes, zig fmt, ReleaseSafe. Theirs: the checked-arithmetic bar. Ours: LN1.

Research bar. CISA memory-safe roadmaps is measured on the public case for memory safety by class. Theirs: the priority order for the safety rungs. Ours: LN3 LN4 LN5 [oncd2024].

Research bar. Rust adoption-tax record is measured on 55 percent of Rust users wait over 10 s per incremental rebuild and complexity is the community's leading worry about its own future. Theirs: the anti-bar: admired-class safety must not cost the adoption taxes. Ours: the safety rungs stay annotation-light (arena and region model) and toolchain.plan B-rungs keep builds sub-second [rustperf2025] [rustsurvey2025].

Research bar. The Midori error model is measured on typed recoverable errors in signatures plus fail-fast abandonment, with ergonomic propagation. Theirs: the errors bar; Go's 2025 capitulation proves the retrofit window closes. Ours: LR1 ships must-use Result and one-character propagation while the corpus is still ours to migrate [midori-errors] [go-errsyntax].

Research bar. Structured concurrency (Trio nurseries, JEP 505, Swift task trees) is measured on spawning only inside a scope that joins its children so cancellation and errors compose. Theirs: the 2026 concurrency floor. Ours: LR2 adds the scoped form over the colorless pool -- the async-split trap was never taken [njs-nursery] [nystrom-colors].

Research bar. The 2025 registry worms is measured on self-replicating npm compromises of 500+ packages via install-time execution and blind version trust. Theirs: why the no-registry content-addressed bet must be MEASURED as an exceed. Ours: LR3 ships the package lane with zero install-time execution and content-addressed identity [tob-supply2025].

Research bar. Capability security (Austral, Pony, the ocap lineage) is measured on authority is a value handed to main, never ambient; a dependency signature IS its permission manifest. Theirs: the supply-chain root fix no mainstream language ships. Ours: LR4 extends the estate's live ocap surface into the type system [austral-caps].

Research bar. Ferrocene qualification is measured on Rust reached safety-critical qualification only by retrofitting a written spec. Theirs: the certification floor NishiOS device lanes will demand. Ours: LR5 writes the spec and conformance suite while the language is small enough to specify [ferrocene].

Research bar. Chromium Rule of 2 is measured on untrustworthy input, an unsafe language and high privilege may never combine. Theirs: the browser inheritance bar: incumbents sandbox around their language. Ours: LR6 attests Nishi Browser parses at privilege under the enforced ring [rule-of-2].

Research bar. IDE-first compiler architecture is measured on the front-end is a lazy query database serving IDE, CLI and agents; retrofitting one is isomorphic to a rewrite. Theirs: the tooling-ring architecture bar. Ours: LN11 serves LSP from the compiler's own front-end and diagnostics, never a second parser [matklad-ide].

Estate-wide usable help and future IDE: PLANNED; foundation first. Operator 2026-09-30: language diagnostics are a consumer of the shared native observation, explanation, authorized repair, independent verification and closure contracts. Use one source of facts for ordinary-human guidance, capability-aware machine actions and compact AI context. A file/line or refusal alone is insufficient. Existing LN49/LN50/LN61-LN64 must qualify causal correctness, safe correction and accepted task completion; elapsed time, human attention, regressions and actual tokens/cost matter. Deterministic checks and transformations precede model help where justified by measured outcomes; uncertain causes remain hypotheses.

Latest recorded release

2026-10-04 · LN121

THE NEW GATES ARE ON AN EXECUTION SURFACE AND THE FEED HAS A BEAT. Five gates were run bare from the serving root (the gate roster's own invocation) and then added to knowledge/gateroster.conf: nx_radarbank_gate 62 of 62, nx_frontier_scan_gate 78 of 78, nx_dumpcheck_gate 179 of 179, nx_leaderboard_fleet_gate 199 of 199, nx_progen_reap_gate 139 of 139; the compiler-backed nx_progen_gate takes minutes and is left off on purpose. knowledge/organ_gate.conf gained the two pairs no derivation rule reaches (nx_swcompare_research to nx_radarbank_gate, nx_leaderboard to nx_leaderboard_fleet_gate). The exploited-vulnerability feed the LN109 census will read now has a stable path and a daily bound clock row (kevfeed, revision 279: nx_research_fetch to knowledge/fetched/cisa_kev_current.json); the first fetch saved 1765906 bytes, the same digest as the pinned citation mirror, which stays untouched because its pin is its hash

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

89 of 154 capability source symbols found|12 of them authored stronger-claims|65 open|coverage 577/1000|adoption 62 full / 27 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 57 vs present 57 · named + unnamed + withheld = 8 vs open 8 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 77130 bytes · gates map: PRIMARY · stamped 35d 4h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_lang.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence lang itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Self-hosted sovereign compiler (LB0)	func main(argc	gen2 == gen3 fixpoint, equiv gate 10/10 -- LANDED	Organ	0 u
Arity and param-type checks (LB1) after LB0	prepass_count_params	Compiler-enforced, bite-proven live -- LANDED 2026-08-05	Organ	0 u
Match exhaustiveness (LB2) after LB0	parse_stmt_match	Missing and unreachable arms refused by name -- LANDED	Organ	0 u
Rich diagnostics (LB3) after LB0	nx_diag_caret	Caret, did-you-mean, multi-error recovery -- LANDED	Organ	0 u
Bounds-checked typed arrays (LB4) after LB0	NX_BOUNDS_CHECK_LIVE	Live checks, cost measured 2.23x -- LANDED	Organ	0 u
DWARF .debug_line (LB5) after LB0	lm_stmt_stamp	Statement-granularity line table, readelf-validated -- LANDED	Organ	0 u
Equality-saturation engine (LB6)	nx_eqsat_union	Seven gates, 93 teeth, all GREEN -- LANDED 2026-08-14	Organ	0 u
Checked integer arithmetic (LN1) after LB0	chk_add_overflow	i64 add and mul trap or refuse on overflow under a declared mode (the shift-count rung already ships); gate proves an overflowing add traps and an in-range add is byte-identical to today	Organ	1 u
Option enforcement (LN2) after LB1	opt_enforce_unwrap	A pointer or Option value must be unwrapped through a checked path before deref in checked mode; gate proves the sentinel-zero deref class (the recurring P2 meta-class) is refused at compile time on a fixture and the stdlib still builds	Organ	1 u
Raw-pointer provenance (LN3) after LB4	bck_ptr_provenance	A raw *u8 deref carries its allocation extent where the compiler can see one (arena allocations, sys_mmap results) and is checked like typed arrays; gate proves the 2026-07-08 READ-TO-NUL over-read fixture traps	Organ	1.5 u
Ownership moves (LN4) after LN3	own_check_move	Move semantics for owned buffers: use after move is a compile error; gate proves a fixture double-use is refused and the existing corpus builds unchanged under the default mode	Organ	2.5 u
Use-after-free prevention (LN5) after LN4	own_check_uaf	With LN4, a freed or released owner cannot be read; gate proves a planted UAF fixture is refused and the arena no-free doctrine is now enforced not assumed	Organ	1.5 u
Data-race typing (LN6) after LN4	sync_send_check	Send-Sync-class marker on values crossing the thread pool; gate proves a non-Send value handed to nx_pool_submit is refused	Organ	2 u
Backend consumes its register allocation (LN7) after LB0	x86_use_regalloc	The x86 emitter keeps allocated values in their registers instead of spilling to stack homes on entry (the witness: loop counter in r12, accumulator in r13, still reloaded); done-rule: nx_probe_bchk_asm shows no home reload and the checked loop bench improves, equiv net 10/10 plus self-host GREEN -- LANDED 2026-08-23 (x86_use_regalloc, nx_x86_64_ctx.nx): the homed loop counter is compared IN PLACE (movq+cmpq scratch copy removed), main() 64->60 instrs, nx_bounds_perf checked hot loop -16.5% (8278us->6912us median); SOUND cross-block forwarding (cut-the-load-block availability, self-host-proven after a merge-unsound draft was caught and rewritten); nx_x86_regalloc_use_gate 5/5 GREEN, 3/5 RED vs banked pre-LN7; equiv 10/10+selfhost GREEN; LN1/LN2/LN3/LN8 still GREEN; promoted a21068ae both roots	Organ	2 u
Eqsat consumed by the backend (LN8) after LB6	opt_eqsat_pass	The pass rewrites real IR through the e-graph under the proven rule table, queued behind the equivalence net; done-rule: x xor x folds where const_fold cannot, controls hold, byte-identical on the 13,201-source population except the rewritten sites	Organ	1.5 u
Canonical formatter (LN9) after LB0	srcfmt_emit	Idempotent formatter over the tokenizer stream; gate proves fmt(fmt(x)) == fmt(x) and the formatted corpus builds to byte-identical binaries -- SHIPPED 2026-08-23: nx_srcfmt live and registered, nx_srcfmt_gate 13/13 GREEN, style measured from the corpus, the token-stream oracle guarantees non-mutation	Organ	1 u
Incremental build cache (LN10) after LB0	inc_cache_lookup	Per-module cache keyed by the closure sha the build door already computes (the B2 cache keys whole targets); gate proves a one-file edit rebuilds only its dependents and the output equals a full build	Organ	2 u
Language server (LN11) after LB3,LN9	lsp_serve	Honest greenfield (nx_lsp.nx does not exist): diagnostics, goto-def and hover over the genealogist's code graph; gate proves initialize plus a diagnostics round-trip against a recorded client transcript	Organ	3 u
Stepping debugger (LN12) after LB5	dbg_step_over	The doctor lane's DT1: break and step on our own binaries over the line table we emit (one contract, two pages)	Organ	3 u
Capturing closures (LN13) after LB0	parse_closure_capture	Closures capturing by value into a compiler-emitted environment struct; gate proves a captured counter increments across calls and a capture of a moved value is refused once LN4 lands	Organ	2 u
Qualified imports (LN14) after LB0	imp_qualified_name	Namespace-qualified names so two organs may export the same identifier; gate proves a shadow collision from the 2026-06-23 census compiles unambiguously with qualification	Organ	1.5 u
Free multi-line expressions (LN15) after LB0	tok_line_continuation	A continuation line opening with a binary operator joins the previous statement instead of becoming a dead statement (the det2x2 bug class); gate proves the fixture that caused the runtime-wide sweep now computes and a lone operator line is a diagnosed error	Organ	1 u
Working f64 arithmetic (LN16) after LB0	x86ctx_emit_f64	Correct SSE2 emission for f64 add sub mul div; done-rule: nx_probe_float run-exit=0 (1.5 plus 1.5 equals 3.0), deliberately low priority under the no-float doctrine	Organ	1 u
Errors as values, enforced with propagation (LR1) after LB1	res_propagate_op	A dropped Result refuses (must-use) and a one-character propagation form rethrows with context; abandonment stays fail-fast (the Midori split); backfill census before enforcement; witness refuse and accept both directions	Organ	2 u
Structured concurrency: scoped spawn (LR2) after LB0	sc_scope_spawn	Spawn exists only inside a scope that joins its children; child error propagates to the scope; cancellation is scoped; the orphan-task shape is unrepresentable; pool witnesses stay green	Organ	2 u
Package lane: content-addressed, zero install-time execution (LR3)	pkg_cas_resolve	An external module resolves by content hash with no version negotiation and no code execution at install; a planted typosquat cannot resolve; the supply-chain bet becomes a measured exceed	Organ	2 u
Language-level capability security (LR4) after LN4	cap_root_main	main receives root capabilities and syscall surfaces require a capability value; a dependency demanding new authority fails to compile; extends the live ocap ops surface into the type system	Organ	3 u
Written language specification plus conformance suite (LR5)	spec_conformance_run	The spec documents syntax, types, memory and refusal semantics; the conformance runner drives the shipped compiler over the suite and a planted deviation goes RED (the Ferrocene lesson taken early)	Organ	3 u
NishiOS and Nishi Browser inheritance attestation (LR6) after LN1,LN4	oa_state_name	The attestation organ rebuilds the nishios kernel and browser closures under the enforcing compiler (ring on, crash guard on) and writes a receipt both compare pages cite; the Rule-of-2 unsafe-language leg is discharged by measurement	Organ	2 u
Sound bounds-check elision (LR7) after LN7	bck_elide_dominated	A dominated in-range re-check is elided ONLY under the blessed dominance oracle (an unsound elision is a silent memory-safety hole, the elision proof gate is the tooth); h2h checked lane approaches the unchecked band	Organ	2 u
Induction-guarded bounds-check elision (LN17) after LN7,LR7	bck_elide_induction	The loop guard proves the single check inside its loop under a fixed rule set (non-escaping local counter, constant resets, guarded constant steps, no store on a guard-to-access path, guard bound not above the array length); nx_bck_iv_gate GREEN with both refusal directions bite-proven, nx_cc_equiv_gate 10/10 plus self-host GREEN, then promote_toolchain and the receipt re-measured by the promoted compiler	Organ	2 u
Checked arithmetic at add-plus-jo cost (LN18) after LN1,LN7	x86ctx_ovf_fuse	The x86 emitter renders the LN1 overflow shape as add then jo (sub then jo, imul then jo) with no spills; nx_chkarith_gate stays GREEN, the equivalence net passes, and the receipt shows the daily mode within 1.3x of the default build on the accumulate loop	Organ	3 u
Integer SIMD reduction vectorization (LN19) after LN8,LN17	opt_vec_reduce	Integer reductions with a provable trip count are emitted as packed adds under the equivalence net; the receipt shows the f1 mode within 1.2x of gcc -O2 on the accumulate loop	Organ	8 u
Loop splitting for non-implied bounds (IRCE) (LN20) after LN17	bck_irce_split	A guard wider than the array yields pre, main and post loops with the main loop check-free; the F2-shaped fixture still traps at exactly the first out-of-range index	Organ	5 u
Compiler modes as declared data (LN21) after LN1,LN7	nxcx_expand_mode	Every mode is a knowledge/lang_modes.conf row expanded into declared flags; an undeclared mode refuses by name; --mode=f1 is byte-identical to its bundle (gate tooth)	Organ	1 u
One receipt arm per mode (LN22) after LN21	h2_build_nx_mode	The h2h receipt carries nishilang-<mode> arms built through --mode and the page renders them beside the rival compilers; nx_lang_h2h_gate GREEN	Organ	1 u
Energy per run on the receipt (LN23) after LN22	h2_energy_arm	Each arm carries package energy from RAPL or a named UNMEASURABLE; the first VALID column comes from a host that exposes powercap	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M1 · Cheap safety wins and honest diagnostics	LN1,LN2,LN3,LN24,LN25,LN27,LN29,LN30,LN31,LN32	8.5 u
M2 · Faster backend and the tooling ring	LN7,LN8,LN9,LN10,LN11,LN12	13 u
M3 · Memory-safety core and ergonomics	LN4,LN5,LN6,LN13,LN14,LN15,LN16	26.5 u
M4 · Industry-complaint ring and OS-browser inheritance (research-admitted 2026-08-19)	LR1,LR2,LR3,LR4,LR5,LR6,LR7	42.5 u
M5 · Real competition: modes, elision, vectorization and energy on one receipt (admitted 2026-09-01 from September 2026 research)	LN17,LN18,LN19,LN20,LN21,LN22,LN23	22 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
A lexer desync is attributed to the file and line that broke (LN24) after LB3	diag_desync_origin	A raw control byte or an unterminated string literal in the LAST user file surfaces as a flood of unknown-name errors inside the auto-appended crash handler with THAT file's line numbers (MEASURED 2026-09-02: a raw NUL inside nx_inline_vec_measure_gate.nx read as twenty errors at nx_crash.nx lines 36 to 99, and the author looked in the wrong file; the control organ nx_probe_hexesc proved high-byte hex escapes ARE honoured, so only the attribution is wrong). The lexer refuses a control byte other than tab, LF and CR by file and line, and reports an unterminated literal at ITS opening line before any later file is expanded. Gate proves a planted NUL and a planted unterminated string are each named at their own file and line, and the neg-control proves a clean corpus builds byte-identical	Organ	1 u
Compiler capacity limits are diagnostics, not asserts (LN25) after LB3	diag_capacity_named	nx_cc dies with nx_assert_lt idx=4096 cap=4096 tag=ir_block_new when one function exceeds the IR block pool (MEASURED 2026-09-02: a 253-name entity if-chain in nx_html_entities.nx), naming the pool and not the function, so the author cannot tell which function to split. Every capacity cap (blocks per function, same-callee call sites, module count) is reported as an error naming the function, the cap, the measured count and the remedy. Gate proves an over-cap function is named with its count and that a function one below the cap compiles unchanged	Organ	1 u
Line tables ride every API build so a fault address resolves on the deployed binary (LN26)	hc_build_debug_armed	SOURCE-LANDED 2026-09-02 (nx_hostctl cmd_buildrun), supervisor rebuild queued. MEASURED: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and the instruction to rebuild with -g; by the time anyone looked the source had moved, and nx_addr2line refused the deployed binary (no .debug_line section). The toolchain already had the whole chain (nx_cc -g emits .file/.loc, nxasm builds DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line decodes it, nx_dwline_e2e_gate runs the -g ELF) and NO build path passed the flag. Now every /api/build passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, rule 17: disarm by writing 0, no rebuild). Done when a freshly built organ answers nx_addr2line with file:line for an address inside its text on the PROMOTED binary AND the byte-identity censuses (nx_gatestale, nx_artifactdrift) treat the appended table as the like-for-like they already recognise in nx_rebuild_drain	Organ	0.5 u
Every diagnostic teaches: one voice with location, caret, why and fix (LN27) after LB3	diag_voice_gate	The parser's teaching errors already print the offending line with a caret (nx_diag_caret), then a why-the-build-stopped line and a fix line; the LN24 desync messages landed 2026-09-02 without them and the operator named the output as not helping a programmer grow to mastery. Estate-wide: every error site in the tokenizer, parser, IR, assembler and the build door carries what, where (file:line plus caret), why and how to fix, in that one voice, and the capacity asserts (LN25) join it. A gate walks every diagnostic emission site in the toolchain sources and refuses a site that prints a location without a why line and a fix line, with the positive control of the existing teaching sites passing and a planted bare location failing. Owner: the lang lane	Organ	2 u
SIMD lane intrinsics for the quantized decode (LN28) after LB3	x86ctx_emit_q4kunpack32s	LANDED 2026-09-02 on the laptop toolchain (blessed through nx_bless_compiler NEUTRAL: nx_cc_equiv_gate 10 of 10 plus self-host GREEN, nx_game_gate no-regression 127 to 127, nx_tc_canary 8 of 8). __q4k_unpack32s(qs, out, sc_lo or sc_hi shl 16) turns one Q4_K sub-block pair (32 packed nibble bytes) into 64 i16 lanes already multiplied by their 6-bit scale, emitted as 14 AVX2 instructions in VEX .byte form (vpmovzxbw, vpsrlw, vpand, vpmullw, vpbroadcastw, vmovups; the mask is built from vpcmpeqd and vpsrlw so no memory constant), five toolchain sites (nx_types OP_Q4KUNPACK32S 151, nx_ir, nx_parse, nx_x86_64_ctx, nx_x86_regalloc). Proof: nx_q4k_simd2_gate 9 of 9 -- lane-exact on 5000 random blocks against the scalar spread, dot-exact on 200 real-shaped rows against BOTH incumbent rulers, two neg-controls. The family this opens: a Q6_K unpack (the 28 fallback rows at 7B), a Q8_0 widen, and a lane-wise i16 multiply-add with the scale folded, each landing the same way. Done-rule met: the emitted unpack replaces about 1.4 scalar ops per weight and the fused dot runs 3.94x faster than the scalar-unpack SIMD dot on the 14-super-block row	Organ	1 u
A field name must belong to the struct it is read from (LN29) after LB3	parse_field_of_struct	A field access p.f where f is not declared by the struct type of p is refused by name; today it resolves against every struct's field table and reads another struct's offset (measured 2026-09-02: f.name_bytes on a *Function compiled and printed junk). Gate proves the fixture is refused with the struct and its real fields named, and the corpus builds unchanged	Organ	1 u
An else with no if is refused, never run (LN30) after LB3	parse_stmt_dangling_else	An else that begins a statement is refused by name with where, why and fix (measured 2026-09-02: a stray else absorbing a missing brace compiled with exit 0 and ran its block unconditionally inside nx_autofix_intake_gate, counting every row twice); gate proves the silent-class and loud-class fixtures are refused by name while else-if chains and plain if/else still compile; the corpus builds unchanged	Organ	1 u
A keyword at module level is named, not blamed on a brace (LN31) after LN30	parse_module_stray_keyword	A statement keyword at module level (var, let, else, return, if, while) is refused with its own cause -- var: module state is `static name: type`; let: const or static; the rest: a function above closed early -- with where, why and fix, and parsing continues to the end gate; gate proves a module-level var is refused by name and its static twin compiles	Organ	0.5 u
A bare block statement is a scope (LN32) after LN31	parse_stmt_block	`{ ... }` at statement start parses as a scoped block: names declared inside die at its closing brace, sibling blocks may reuse a name, a leaked name is refused by name; the block fixture runs and returns its computed value; the three estate sources written with C-style inline blocks build	Organ	0.5 u
wasm threads from the sovereign compiler: shared memory, atomics, wait and notify (LN33) after LN6	wat_mem_shared	OPERATOR 2026-09-03 (max performance from current browsers, a launch that needs no install): the served world pages already carry COOP same-origin and COEP require-corp so SharedArrayBuffer is unlocked, and nothing spends it because the sovereign wasm backend emits no threads -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify, SharedArrayBuffer named only in a router comment. Done when nx_wasm and nx_wasm_scalararm emit a shared memory with a declared maximum plus the 0xFE-prefixed atomic loads, stores, rmw ops, wait and notify for i32 and i64, nx_compile_wat lowers them, NishiLang surfaces them as an atomic intrinsic family beside the LN6 send marker (a struct shared across Workers must be send-marked or the compiler refuses by name), and a gate instantiates the module in the sovereign VM twin AND in a browser over the CDP wire with two Workers incrementing one shared counter without loss, the neg-control being the non-atomic add that loses increments; the GE27 digest tooth then reads the threaded frame bit-identical to the single-thread frame. Consumers: gameengine GE30 (tiles across every core) and performance PF13 (the tick off the render thread)	Organ	2 u
The same atomic names lower to hardware on the native lanes: LOCK-prefixed x86-64, rv64 AMO, futex wait and notify (LN34) after LN33	rv_home_t6	OPERATOR 2026-09-03 (scale from a sensor to a supercomputer, the browser is never the ceiling): the __atomic_* builtins (nx_atom.nx) lower to OP_ATOMIC_*: LOCK on x86-64 (pre-existing), 0xFE on wasm (LN33), lr/sc + AMO on rv64 (LN34 source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim and on the NAS); done when nx_x86_64 lowers nx_atomic_add32 and family to LOCK xadd, cmpxchg, xchg and mfence, the rv64 backend to amoadd, amoswap, lr and sc and fence, nx_atomic_wait32 and notify to the futex syscall on Linux and to the NishiOS kernel wait queue, all behind the SAME call names the wasm lane intercepts (one source, three lowerings), proven by a two-worker nx_pool counter that loses ZERO increments natively where the reference bodies lose some (the same lost-update neg-control the browser proof used), plus the LN6 send-marker refusing an unmarked struct shared through them	Organ	2 u
memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling (LN35) after LN33	wasm_memory64	the emitter wraps every address to i32 and the WAT compiler encodes 32-bit limits, so a world larger than 65536 pages cannot exist on the browser door; done when a module declaring `static nx_wasm_memory64_req: i64 = 1` emits `(memory i64 MIN MAX)` (the memory64 limits flag), every load, store and atomic drops the i32 wrap, the mmap helper grows in i64, the WAT compiler and the VM twin carry the flag, a module past the wasm32 ceiling instantiates in a memory64 browser over the CDP wire, and a module WITHOUT the declaration still emits wasm32 byte-identical to today	Organ	2 u
An f64 ordered compare of a single-use loaded operand is correct (LN37) after -	x86ctx_cmp_f64_operands	LANDED 2026-09-03. The f64 compare emitter cleared the G1 op0-in-rax fact BEFORE the operand loads, so a G4-elided operand was re-read from a slot nothing wrote and tripped .G4_elided_slot_load_bug on any f64 ordered compare of a loaded value; the clear now happens after the ordering-key transform. Toolchain 6cf44630 canary GREEN.	Organ	1 u
A NaN operand compares unordered: every ordered predicate false, only != true (LN38) after LN37	x86ctx_emit_f64_nan_guard	LANDED 2026-09-03. The ordering-key transform made a NaN a total order so n != n read false and a sign-set NaN sorted below every number; an integer-only guard (exponent 2047 and mantissa nonzero, no ucomisd needed) now forces the IEEE-correct flags. Proven by nx_f64_gate 27 of 27 GREEN and bite RED against the pre-fix compiler.	Organ	1 u
Decimal exponent float literals (LN36) after -	lex_number_exponent	OPEN. lex_number in nx_tokenizer accepts a fraction and f32 or f64 suffixes but has no exponent form, so 1e-9 does not lex; today such constants are spelled in full decimals. Cheapest of the three literal gaps.	Organ	1 u
Float and f64 constant-expressions (LN39) after -	const_eval_f64	OPEN. const_eval_primary in nx_parse accepts only integer literals, so const X: f64 = 0.5 is refused; today f64 module constants are written as zero-argument functions.	Organ	1 u
A large-fraction literal is refused, never looped on (LN40) after -	fp64_from_parts_bounded	OPEN. A 20-digit fraction overflows the exact-rational packer in nx_quant (10 to the 20 exceeds i64) and the compiler loops instead of refusing; today tiny values like 1e-20 are built by multiplying representable literals.	Organ	1 u
nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes (LN42)	axc_apply_section	THE BUS STOP UNDER LN36, SPECIFIED FROM THE SOURCE RATHER THAN LEFT AS A COMPLAINT. Today a writable static may only be ZERO-initialised: x86ctx_emit_module_globals emits a loud invalid line for any non-zero one because .rodata is read-only on the GNU lane and nxasm maps .data (and .bss) to section id 2 = IGNORE (axc_apply_section, nxasm_x86.nx:1051-1064). But nxasm's section 1 tail is ALREADY WRITABLE -- that is exactly how .lcomm works, and its own comment says 'zero-filled MUTABLE slot ... our single-image model appends to the data tail' -- so .data is a both-lanes-correct emission that was simply never taught. Done when: axc_apply_section maps a bare .data and .section .data to section 1; x86ctx_emit_module_globals emits .data + .Lg<id>: + a .byte list for writable non-zero globals in a SECOND pass after the rodata stream (so output stays byte-identical when no such global exists, which nx_cc_equiv_gate proves); a gate compiles a fixture with static x: i64 = 42, WRITES to x and reads it back, with a neg-control that the pre-fix compiler refuses it; and the toolchain promote is canaried. Unblocks the three organs already carrying the workaround by name (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib) and every future dual-target module	Organ	2 u
The wasm memory is declared on the BUILD LANE so one source builds at a sensor's memory and at a supercomputer's (LN41) after LN33	watd_atoi	LANDED 2026-09-03. LN33 let a module declare its memory with statics; a DUAL-TARGET module cannot, because the native lane refuses a non-zero static initializer by name, and it should not have to -- a target's limit is a declared door on a ladder, never a constant in the source. nx_compile_wat --shared <pages_req> <pages_max> moves it to the build lane, --nothreads emits the unshared twin at the same declared size, and absent the flag the WAT is byte-identical. nx_wasm_threads_gate 37/37 GREEN on the NAS; driver promoted 6c6f5f4d, gate promoted 1895335d.	Organ	1 u
Bounds-check elision with a cost model (LN43) after LR7	bck_elide_cost_model	The modulo arm of nx_bck_elide_gate is GATED rather than merely published, elision is DECLINED on shapes that measure slower, and the div-free win is preserved at or above 1.9x across three sequential rounds on the live compiler	Organ	3 u
An unclosed brace is reported where it was opened (LN45) after -	nxcx_brace_balance	LANDED 2026-09-03. A single missing closing brace made every later declaration parse INSIDE that block, so the module-level const on line 2 of nx_crash.nx -- the crash handler the builder APPENDS to every program -- read as an assignment and the whole cascade was attributed to a file the author never wrote. The driver now walks the TOKEN stream after lexing (so a brace inside a string or comment cannot confuse it), remembers the OUTERMOST still-open brace, and refuses with a caret on it, the depth, and the reason the errors would otherwise surface elsewhere. A stray closer gets its own message.	Organ	1 u
The build lane declares its compile mode (LN44) after LR7	cb_mode_policy	The mode organs are compiled with is DATA read by the build lane, not an omission; a target moved to the f1 bundle is proven output-identical by nx_behaveprobe before the move, and the published h2h receipt shows the default arm closing on the f1 arm	Organ	3 u
Every parser refusal carries a location, a caret and a fix (LN46) after -	nx_diag_organ_at	LANDED 2026-09-03 (symbol repointed 2026-09-27 from the never-built name nx_pd_line to the real entry point nx_diag_organ_at in runtime/nx_parse.nx, so the contract stops reading UNMAPPED). parse_die and two sibling raw-write refusal sites printed a bare one-line sentence with no file, no line, no caret and no fix -- 35 call sites in all. nx_diag_organ_at had existed since the file-attribution pass, waiting for a line number that parse_die never had. Every token in the unit passes through advance_tok, so recording line and col at that ONE chokepoint gives every site a truthful location without touching a single call site; a site reached before any token was consumed keeps the bare form rather than pointing at line 0.	Organ	1 u
The wat lane refuses what it cannot lower (LN13a) after LB0	wat_die_unlowerable	LANDED 2026-09-04. The precondition under LN13, and it is worth a rung on its own because it closes a silent-miscompile class that existed with no closures anywhere. The wat backend answered an IR opcode it had no arm for with a WAT COMMENT and return 0, without storing a result local, so the module assembled, instantiated and RAN while computing zero at that instruction. Only 41 of the 141 declared opcodes have an arm in that emitter and OP_CALL_INDIRECT 144 was one of the 100 that did not, which is what every function-pointer call lowers to. Done when a function-pointer call through nx_compile_wat is refused BY NAME with its opcode number and emits no module, an ordinary direct call still compiles byte-identically, and both are bound in a gate that goes RED against the pre-fix binary.	Organ	1 u
Board-level journal anchor for lang (LN)	-	BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 5 log rows against the id LN, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.	Board	0 u
Cross-domain journal anchor: autodev entries recorded on this board (autodev)	-	DECLARED 2026-09-04 by nx_board_idref_gate. Two log rows on THIS board are addressed to the id autodev and describe work in the autodev DOMAIN, not in lang: they record nx_autofix_intake_gate going RED 3 of 5 to GREEN 5 of 5. They are also an EXACT DUPLICATE PAIR at the same epoch with identical text, which is the signature of a double-applied append rather than two findings. Declaring the anchor is additive and makes them resolvable instead of dangling; it does NOT make them correctly filed. THE OWNING LANE SHOULD RE-JOURNAL THAT FINDING ON THE AUTODEV BOARD against a real autodev rung, after which this anchor can be retired through nx_retire_path. Nothing is deleted here on purpose: history is additive and a mis-addressed record still is a record.	Board	0 u
Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity (LN47)	lc_closure_scope	DONE-RULE PRE-DECLARED 2026-09-04, before the organ exists. The census resolves each program's transitive imports the way the builder does (_hdl_build/ first, then runtime/) and stamps every ERR row PROVEN or UNPROVEN by whether EVERY file in the closure is byte-identical to the estate manifest, not merely the erroring file. Done when: the organ reproduces the hand-computed partition of 2026-09-04 (135 proven, 119 unproven, 30 excluded, summing to 284) from the same two inputs, AND a planted stale import under a byte-identical leaf moves that row from PROVEN to UNPROVEN. The second half is the anti-vacuity tooth: a scoper that never demotes a row has not been shown to fire.	Organ	3 u
A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect (LN48)	lc_expect_fail	DONE-RULE PRE-DECLARED 2026-09-04. Every mainstream toolchain declares negative tests in the fixture -- rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck -- and the estate has no equivalent, so its compile-refusal worklist contains rows where fixing them destroys the control. Done when: a declaration field exists and the census partitions expect-fail from defect MECHANICALLY, the 7 fixtures found on 2026-09-04 by their own prose are all declared, AND at least one fixture that carries no marker phrase (z.nx and the _nxiq_ family are the known cases) is caught by the declaration and would have been missed by the vocabulary scan. That last clause exists because the 7 is a FLOOR and a mechanism that only reproduces the floor has added nothing.	Organ	2 u
Compiler diagnostics are GRADED against a known-bad fixture set, not asserted (LN49) after LN46	cc_diag_grade	DONE-RULE PRE-DECLARED 2026-09-04. The shipping compiler already emits the three-part shape Elm set the bar for -- a caret line, a why-the-build-stopped clause and a fix clause -- and names the enclosing construct, but NONE of that is measured, so the quality claim on this board is an assertion. Done when: a fixture set of known-bad programs with expected span and expected suggestion is scored for span accuracy and suggestion correctness, the score is PUBLISHED on this page rather than claimed, and a deliberately regressed diagnostic (a refusal stripped of its caret) lowers the score. Carries its own negative control by construction.	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
M6 · The measurement lab: the field's instruments as oracles, our evidence, and sovereign twins any seat can run (admitted 2026-09-04 under the estate-wide measurement standing order)	LN47,LN48,LN49	8 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream (LN50)	nx_diag_object	DONE-RULE PRE-DECLARED 2026-09-04. The same object renders through all three emitters [gcc16] [rustc-annotate]; a planted nested child must appear in all three; the machine sink validates against the pinned schema (LN56).	Organ	3 u
A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal (LN51) after LN50	lc_diag_snapshot	DONE-RULE PRE-DECLARED 2026-09-04. Snapshot per refusal over the whole census, count printed [rustc-annotate]; a renderer that drops a nested child must show at least one differing snapshot; an identical renderer must show zero.	Organ	2 u
A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore (LN52) after LN48	lc_known_bug_id	DONE-RULE PRE-DECLARED 2026-09-04. Parse refusal without an id [rustc-directives] [llvm231]; fixing the planted bug must turn the row RED; rows per class printed so zero of zero cannot read green. Extends LN48.	Organ	1 u
After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason (LN53) after LN47	lc_rebuild_partition	DONE-RULE PRE-DECLARED 2026-09-04. Partition regressed, fixed, spurious-regressed, spurious-fixed, unchanged sums to the population [crater159343] [fedora45]; a planted admission refusal lands in spurious with its reason; a retry lane re-runs only changed rows.	Organ	3 u
Three optimisation passes emit certificates an independent checker accepts over the whole census (LN54)	opt_pass_certificate	DONE-RULE PRE-DECLARED 2026-09-04. Unreachable-code, dead-assignment and constant-fold certificates checked by code shared with no pass, count printed, self-host rebuild still byte-identical [rinard10x] [compcert318] [brack]; a mutant that folds one constant wrongly is refused naming pass and site.	Organ	3 u
A missed-peephole candidate is scored sound and profitable on two printed axes (LN55)	opt_peephole_bench	DONE-RULE PRE-DECLARED 2026-09-04. Sound by the equivalence probe, profitable by instruction count [peepholebench]; an unsound profitable rewrite reports REJECTED, never one of two.	Organ	1 u
Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent (LN56) after LN50	cc_diag_schema	DONE-RULE PRE-DECLARED 2026-09-04. Schema mirrored and pinned [sarif-tc] [gcc-sarif-schema]; a planted malformed diagnostic is refused by field name; removing the validator yields SKIP, never GREEN.	Organ	1 u
The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator (LN57)	x86_regalloc_backtrack	DONE-RULE PRE-DECLARED 2026-09-04. Behavioural equality over a printed count of generated functions [regalloc3]; a planted mis-assignment is caught by the fuzz lane; depends on the allocator watch x86_use_regalloc.	Organ	3 u
Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses (LN58)	eqsat_bounded_acyclic	DONE-RULE PRE-DECLARED 2026-09-04. Bound in a conf row [egraphs2026]; the stochastic control and the bounded run agree on the census subset, counts printed; a bound of zero must be refused as vacuous.	Organ	2 u
Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane (LN59)	sp_mutator_from_bug	DONE-RULE PRE-DECLARED 2026-09-04. Each mutator names the defect row it came from [issuemut]; a replayed mutator must reproduce its origin defect on the pre-fix binary and pass on the fixed one; prerequisite: defect rows carry their triggering input.	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M7 · September 2026 SOTA: correctness assurance, diagnostics and bootstrap trust, admitted from the verified compiler sweep as watches and pre-declared contracts	LN50,LN51,LN52,LN53,LN54,LN55,LN56,LN57,LN58,LN59,LN66	24 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning (LN60) after LN49	count_global_tokens	DONE-RULE PRE-DECLARED 2026-09-05 (operator, same day: numbers need evidence on why they are set or need to be dynamic, no guessing; this belongs to the NishiLang shape and theory with research and reasoning as of September 2026). MEASURED CAUSE: parse_module derived its FUNCTION pool from counted func tokens after a 256-slot pool corrupted nxc.nx twice (T#selfhost-004/006), but kept a DECLARED 4096 for the GLOBALS pool behind a comment claiming it could not be derived -- and on 2026-09-05 the nx_wgsl unit (shader front-end + both backends + the world and cast shaders) reached 4097 and the build stopped at the guard. It CAN be derived: every global is anchored to a TK_STRING, TK_STATIC, TK_FLOAT/TK_FLOAT_F32 or TK_FUNC token, so the bound is that sum plus a NAMED slack for backend-synthesised entries, wrong only in the direction of surplus (address space never faulted in). THEORY, as of Sept 2026: a bound is a claim about the input; a claim with no witness is a guess that fails in silence when the input grows past the day it was typed, and the estate has now paid for that three times in ONE file. The language shape is therefore: (a) a pool is sized by a pass over the thing it will hold; (b) where the size is genuinely unknowable in advance (a network body), the bound is NAMED for that one purpose and its exhaustion ANNOUNCES; (c) a const that sizes anything carries, in its own comment, the measurement or the spec it came from, so a reader can re-derive it. Done when: (1) count_global_tokens lands, nx_wgsl builds past 4096 and the guard stays armed (a planted under-count refuses BY NAME, bite-proven); (2) a census organ walks the toolchain closure (nx_types, nx_lex_kinds, nx_tokenizer, nx_parse, nx_ir, nx_opt, nx_x86_64_ctx, nxasm_x86, nx_compile_x86) and lists EVERY const that sizes a pool, cap, buffer or table with a derivation class -- DERIVED-FROM-INPUT, EVIDENCED (the adjacent comment names a measurement or a published spec) or BARE -- published on this page, BARE ratcheting to zero; (3) the research is fetched, pinned and cited (candidate sources to fetch, NOT yet citations: Zig std allocator and ArrayList growth, Rust Vec amortised growth and the RFC on capacity overflow, LLVM SmallVector, the Go slice growth policy, plus the estate's own three pool incidents as the measured cost) so the principle is a written part of the NishiLang shape rather than a memory	Organ	3 u
Verifier-in-the-loop compiler door (LN61) after LB0	vl_retry_until_green	The September-2026 shape for making a weak or local model produce correct programs in a language it does not know. Eiffel-tools [eiffeltools-2609-03086] pairs a language server with a STATIC VERIFIER and retries until the program verifies, fixing 76 to 95 percent of bugs across two datasets and three models, and the verifier is what carries the correctness rather than the model. We already own the harder half: nx_cc refuses, and the gates decide. What is missing is a MACHINE-READABLE refusal plus a retry protocol a weak engine can drive without a frontier model in the loop, so that compiler refusals become a control signal instead of prose a human reads. This is the highest-leverage rung on the board because it converts all future organ authoring from frontier-token work into local work, and organ authoring is currently the frontier seat's entire residual against the 96-new-token local ceiling. Done-rule: a local engine reaches a declared first-try-green rate on a held-out organ set, measured by the incumbent nx_build_firsttry_lib and not by a new ruler.	Organ	4 u
The estate as a retrieval-time tool catalogue with a router (LN62) after LN61	tp_route_primitive	HEART [heart-2609-01736] is this estate's own thesis measured by someone else, and its full text is stronger than its abstract: the backbone is Qwen3-8B, an 8B OPEN model, driving Planner, Router, Verifier and the Tool Primitives themselves, reaching 84 percent task completion on 50 real-world tasks against GPT-5.4 at 20 and Claude-4.6-Sonnet at 24, at up to 7.4 times lower API cost, and HEART on Qwen3-8B matches the GPT-5.4 hybrid on most metrics at over 12 times less cost. Two design points transfer directly. Tools are wrapped so SCHEMA RESOLUTION HAPPENS INSIDE THE TOOL rather than by enumerating raw API schemas in the caller's context, and the orchestration layer and the execution layer scale INDEPENDENTLY. We already hold the catalogue of roughly 940 registered tools, the retriever in nx_capsearch, the Verifier in the gate fleet and a Planner in nx_goalmap and nx_compare_rank. The thin part is the ROUTER and the natural-language tool wrapper. Done-rule: a local engine completes a declared task set through the router at a measured cost ratio against the frontier path, with the ratio published beside the completion rate so a cost win that loses quality is visible as a regression.	Organ	4 u
Test-time generate-evaluate-refine for organ authoring (LN63) after LN61	gc_refine_round	GenCorrect [gencorrect-2609-02849] decomposes cleanly in full text and the decomposition is the argument: Nemotron-3-Nano-CC at 3B ACTIVE parameters goes 130 to 280 after SFT to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, past the 438.3 gold threshold. Post-training bought 161 points and the test-time loop bought 177, and the Ultra model gained 198 points from the loop with no code-specific RL at all. The transfer is exact: propose N organ candidates, run the GATE on each, refine from the gate's own output, repeat within a declared round budget. The estate already owns every piece except the loop itself, in nx_gate_bite and nx_sov_build_run with build-only. This is the direct answer to the 96-new-token local ceiling, because the loop trades ROUNDS for parameters rather than needing a bigger model. Done-rule: a declared organ set is authored to gate-green by a local engine within a named round budget, with the round count and the budget both published, and a neg-control organ that must NOT reach green.	Organ	4 u
A compact model-facing view of the IR (LN64) after LN61	mir_emit_compact	PrEx [prex-2609-00579] settles what NOT to build here: models lean on pre-training priors rather than applying semantics handed to them, and are WORST under KeywordSwap and KeywordObf, the shifts where familiar symbol meanings must be overridden. NishiLang is exactly that case and worse, because it resembles C without matching it, so a model's priors are ACTIVELY WRONG rather than merely absent, and the failure direction is the flattering one since models frequently declare invalid programs executable. So no spec-stuffing and no fine-tuning rung will be opened on this board. What DOES transfer is representation: measured on a quantized local model, a compact control-flow representation fit the context where the AST overflowed, and REPRESENTATION CHOICE BEAT MODEL SIZE. We already have an IR. Emit a compact model-facing VIEW of it so the local ceiling rises without anyone claiming the model understands the language. Done-rule: the view is emitted from the existing IR with no second IR created, and a declared task set measures higher local first-try-green with the view than without it, the comparison run on the same engine.	Organ	4 u
Population-complete research currency, mechanically verified (LN65) after LB0	ac_census_complete	The sotabar and barscan law needs an attestation that a month's listing was actually READ, and until now that attestation was a seat's word. nx_arxiv_census composes the incumbents rather than duplicating them, taking se_fetch from nx_search_extern and em_int_after with em_collect_yms and em_maxym from nx_search_emerge, and asks the ONE question neither incumbent asks: does opensearch:totalResults reconcile against the entries actually delivered. Equal means the window is a POPULATION and an absence claim over it is sound; fewer means a SAMPLE wearing a population's clothes and absence over it is UNPROVEN. This is what converts the measured zero behind sb-slm-code-whitespace from an assertion into a verdict, and it also produces the barscan newest= field mechanically via em_maxym. The currency control for the agent bar is the SWE-bench listing [arxiv-swebench-2026-09]. Done-rule: the organ exits COMPLETE on a window whose counters reconcile, CAPPED on one where max_results truncates the population, and a bite plants a deliberately truncated window that MUST be named CAPPED rather than passing.	Organ	4 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.

best-in-class (lt-peer-systems), dated by sb-lang-frontier = 2026-09 ATTESTED. Be a peer of Rust, Zig and Go on the axes the public bug dumps actually blame: raw-pointer provenance, ownership and use-after-free, checked arithmetic, option enforcement, data-race typing, and a backend that consumes its own register allocation instead of discarding it. The compiler, its diagnostics, its line tables and its equality-saturation engine are already landed and proven; what is unmet is the safety and codegen band, and it is unmet on evidence rather than on design. ref arxiv-cspl-2026-09

frontier (lt-typed-security), dated by sb-lang-frontier = 2026-09 ATTESTED. Enforce security properties BY TYPING AND CONSTRUCTION rather than by discipline, which is where September 2026 cs.PL actually sits: type-directed secure-by-construction compilation and verified capability compartmentalisation, both proved rather than asserted. Our capability-security, provenance, ownership and use-after-free rungs are on that axis, and the exceed candidate is that a sovereign compiler can carry the property end to end from its own source rather than bolting it onto someone else's toolchain. ref arxiv-cspl-2026-09

Rung	Role	Toward	Stands on	Why
LB0	substrate	lt-peer-systems	-	The self-hosted compiler is what every other rung on this board is written in and compiled by; nothing here is reachable without it.
LB1	substrate	lt-peer-systems	LB0	Arity and parameter-type checking is the floor the safety rungs extend rather than a claim they compete on.
LB2	substrate	lt-peer-systems	LB0	Match exhaustiveness is the enforcement mechanism option handling and error propagation both build on.
LB3	substrate	lt-peer-systems	LB0	Rich diagnostics with caret and did-you-mean are the substrate every later diagnostic rung refines.
LB4	substrate	lt-peer-systems	LB0	Bounds-checked typed arrays are the checked baseline the elision rungs are measured against.
LB5	substrate	lt-peer-systems	LB0	The DWARF line table is what makes a fault address resolvable and the stepping debugger possible.
LB6	substrate	lt-peer-systems	-	The equality-saturation engine is the optimiser substrate the backend consumption rung spends.
LN1	contender	lt-peer-systems	LB0	Checked integer arithmetic is a direct peer-parity number against the rival languages.
LN2	contender	lt-peer-systems	LB1	Option enforcement is one of the named axes the public bug dumps blame, so its done-rule is a comparison.
LN3	contender	lt-typed-security	LB4	Raw-pointer provenance is enforcement by typing, which is the frontier axis this month names.
LN4	contender	lt-typed-security	LN3	Ownership moves make the unsafe shape unrepresentable rather than merely discouraged.
LN5	contender	lt-typed-security	LN4	Use-after-free prevention turns the arena no-free doctrine from an assumption into an enforced property.
LN6	contender	lt-typed-security	LN4	Data-race typing is the send and sync marker class, a typed-security claim rather than a convention.
LN7	contender	lt-peer-systems	LB0	A backend that consumes its register allocation is the codegen parity number against gcc-class output.
LN8	contender	lt-peer-systems	LB6	Eqsat consumed by the backend is where the optimiser stops being a demonstration and becomes performance.
LN9	substrate	lt-peer-systems	LB0	A canonical formatter is tooling the peer languages all have; it enables adoption rather than winning a number.
LN10	substrate	lt-peer-systems	LB0	The incremental build cache is what makes the whole loop affordable enough to iterate on.
LN11	substrate	lt-peer-systems	LB3,LN9	A language server is table stakes tooling the target consumes, not an axis it competes on.
LN12	substrate	lt-peer-systems	LB5	A stepping debugger consumes the line table and makes failures inspectable.
LN13	substrate	lt-peer-systems	LB0	Capturing closures are expressiveness the safety rungs then have to cover.
LN13a	substrate	lt-peer-systems	LB0	Refusing what the wat lane cannot lower closes a silent-miscompile class beneath every wasm claim.
LN14	substrate	lt-peer-systems	LB0	Qualified imports are the namespacing the corpus needs before it can scale.
LN15	substrate	lt-peer-systems	LB0	Free multi-line expressions are ergonomics, enabling rather than competing.
LN16	substrate	lt-peer-systems	LB0	Working f64 arithmetic is deliberately low priority under the no-float doctrine and enables the float rungs only.
LN17	contender	lt-peer-systems	LN7,LR7	Induction-guarded elision is a measured performance number against the unchecked band.
LN18	contender	lt-peer-systems	LN1,LN7	Checked arithmetic at add-plus-jo cost is the number that decides whether safety is free.
LN19	contender	lt-peer-systems	LN8,LN17	Integer SIMD reduction is an explicit ratio against gcc -O2 on the accumulate loop.
LN20	contender	lt-peer-systems	LN17	Loop splitting for non-implied bounds is a codegen capability the rivals ship and we are measured on.
LN21	substrate	lt-peer-systems	LN1,LN7	Compiler modes as declared data is the mechanism every receipt arm reads.
LN22	arm	lt-peer-systems	LN21	One receipt arm per mode triangulates the performance claims without itself being a performance number.
LN23	arm	lt-peer-systems	LN22	Energy per run is a second independent axis beside speed, which is what an arm is for.
LN24	substrate	lt-peer-systems	LB3	Attributing a lexer desync to its true file and line is diagnostic machinery the whole board rests on.
LN25	substrate	lt-peer-systems	LB3	Capacity limits as diagnostics rather than asserts is what stops a cap from reading as a crash.
LN26	substrate	lt-peer-systems	-	Line tables riding every API build is what makes a deployed fault address resolvable at all.
LN27	substrate	lt-peer-systems	LB3	One diagnostic voice with location, caret, why and fix is the standard the later renderer rungs implement.
LN28	substrate	lt-peer-systems	LB3	SIMD lane intrinsics are the primitive the quantized decode consumes.
LN29	substrate	lt-peer-systems	LB3	Refusing a field name that does not belong to its struct closes a whole class of silent misreads.
LN30	substrate	lt-peer-systems	LB3	An else with no if refused rather than run removes a control-flow trap from the language.
LN31	substrate	lt-peer-systems	LN30	Naming a stray module-level keyword stops the parser blaming an innocent brace.
LN32	substrate	lt-peer-systems	LN31	A bare block statement being a scope is a semantics fix the safety rungs depend on.
LN33	arm	lt-typed-security	LN6	wasm threads with shared memory and atomics triangulate the concurrency story on a second target.
LN34	arm	lt-typed-security	LN33	The same atomic names lowering to hardware on the native lanes is the cross-target witness for LN33.
LN35	arm	lt-peer-systems	LN33	memory64 makes the wasm32 four gigabyte wall a declared door rather than a ceiling.
LN36	substrate	lt-peer-systems	-	Decimal exponent literals are the cheapest of the literal gaps and enable the float rungs.
LN37	substrate	lt-peer-systems	-	A correct ordered f64 compare of a single-use loaded operand is codegen correctness beneath any float claim.
LN38	substrate	lt-peer-systems	LN37	NaN comparing unordered on every ordered predicate is the semantics the float rungs require.
LN39	substrate	lt-peer-systems	-	Float constant-expressions remove the zero-argument-function workaround from module constants.
LN40	substrate	lt-peer-systems	-	Refusing a large-fraction literal rather than looping on it removes a hang from the lexer.
LN41	substrate	lt-peer-systems	LN33	Declaring the wasm memory on the build lane lets one source build at a sensible size on every target.
LN42	substrate	lt-peer-systems	-	Assembling non-zero writable static initialisers is an assembler capability the language depends on.
LN43	contender	lt-peer-systems	LR7	Bounds-check elision with a cost model is the number that decides whether checks are affordable.
LN44	substrate	lt-peer-systems	LR7	The build lane declaring its compile mode is what makes any mode-dependent claim readable.
LN45	substrate	lt-peer-systems	-	Reporting an unclosed brace where it was OPENED is diagnostic quality the rivals already have.
LN46	substrate	lt-peer-systems	-	Every parser refusal carrying a location, caret and fix is the LN27 standard made universal.
LN47	substrate	lt-peer-systems	-	Scoping a refusal figure by closure identity rather than leaf identity is what makes the census honest.
LN48	substrate	lt-peer-systems	-	A must-not-compile fixture declaring itself lets a refusal census tell a real refusal from an accident.
LN49	arm	lt-peer-systems	LN46	Grading diagnostics against a known-bad fixture set is an independent referee on diagnostic quality.
LN50	substrate	lt-peer-systems	-	One diagnostic object feeding a nested renderer is the machinery the schema and swap rungs check.
LN51	arm	lt-peer-systems	LN50	Adjudicating a renderer swap by byte-diff count is a referee on a change rather than a capability claim.
LN52	substrate	lt-peer-systems	LN48	Refusing a known-bug row without an issue id extends LN48 so a count of zero cannot read green.
LN53	substrate	lt-peer-systems	LN47	Re-checking every downstream source after a toolchain change is what makes a toolchain claim trustworthy.
LN54	contender	lt-typed-security	-	Optimisation passes emitting certificates an independent checker validates is proof by construction.
LN55	arm	lt-peer-systems	-	Scoring a missed peephole sound and profitable is a referee on the optimiser, not a rival number.
LN56	substrate	lt-peer-systems	LN50	Validating every machine-readable diagnostic against a pinned schema is what stops silent format drift.
LN57	contender	lt-peer-systems	-	An allocator that backtracks on spill pressure is a direct codegen quality number.
LN58	substrate	lt-peer-systems	-	Bounding saturation acyclically with the bound as data keeps the eqsat engine terminating and readable.
LN59	arm	lt-peer-systems	-	Extracting mutators from the estate's own compiler defects is a referee that grows from real history.
LN60	substrate	lt-peer-systems	LN49	Deriving every pool, cap and buffer instead of guessing removes a defect generator from the toolchain.
LN61	arm	lt-peer-systems	LB0	The verifier-in-the-loop door triangulates whether a weak engine can author organs; it is not a language axis.
LN62	arm	lt-peer-systems	LN61	The estate as a retrieval-time tool catalogue is an authoring-cost arm rather than a language claim.
LN63	arm	lt-peer-systems	LN61	Test-time generate-evaluate-refine is an authoring-loop arm measured in rounds, not in language capability.
LN64	arm	lt-peer-systems	LN61	A compact model-facing IR view raises what a local engine can author without changing the language.
LN65	arm	lt-peer-systems	LB0	Population-complete research currency is the measurement apparatus every bar on this board is graded by.
LN	substrate	lt-peer-systems	-	The board-level journal anchor is the record-keeping every claim on this board is written against.
LR1	contender	lt-peer-systems	LB1	Errors as values with enforced propagation is a named peer-parity axis against Rust and Go.
LR2	contender	lt-typed-security	LB0	Structured concurrency making the orphan-task shape unrepresentable is enforcement by construction.
LR3	arm	lt-typed-security	-	A content-addressed package lane with zero install-time execution triangulates supply-chain safety.
LR4	contender	lt-typed-security	LN4	Language-level capability security is THE frontier axis this month names, proved rather than asserted.
LR5	substrate	lt-peer-systems	-	A written specification with a conformance suite is what any peer claim has to be measured against.
LR6	arm	lt-typed-security	LN1,LN4	The NishiOS and browser inheritance attestation is an independent witness that the language leg discharges.
LR7	contender	lt-peer-systems	LN7	Sound bounds-check elision is the number that brings the checked lane toward the unchecked band.
autodev	substrate	lt-peer-systems	-	The cross-domain journal anchor exists so log rows addressed to the autodev domain on this board have a referent; it is record-keeping substrate and never a capability claim.

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The dot builtins lower on every door (LN66) after LN33	wat_lower_q8blkdot	__i16_dot and __q8blk_i16dot (OP_I16DOT, OP_Q8BLKDOT) lower only in nx_x86_64_ctx today, so a source that composes them cannot be built for the wasm or rv64 doors; the ONE SOURCE, MANY DOORS order (2026-09-03) requires a lowering on each door: nx_compile_wat lowers both ops to i16x8 and i32x4 SIMD where the profile has v128 and to a plain loop under --nothreads or a v128-less profile, the rv64 emitter lowers to a scalar loop first (the vector extension later), and the feature program _q8blkdot_minrepro.nx must exit 0 on every door it is built for. DONE-RULE: nx_cc_equiv_gate's feature leg runs the minrepro through the wat door in the estate wasm VM (nx_wasm_vm_verify) and through nx_rv64_sim with exit 0 on both, and the widest-block and most-negative-block answers are byte-identical on all three doors; a door that lacks the lowering must REFUSE the op by name at compile time, never emit a silent zero	Organ	3 u

Rung	Role	Toward	Stands on	Why
LN66	substrate	lt-peer-systems	LN33	a peer compiler lowers one intrinsic on every target it claims; a builtin that exists on one door is a door-specific dialect wearing the language's name

frontier (lt-superior), dated by sb-lang-rivals = 2026-10 FRESH. SUPERIOR, not peer: on every axis a rival publishes (run-time speed on the h2h checksum against gcc -O2 and Rust, compile time, binary size, energy by the Energy-Languages method, the CWE classes the public bug dumps blame, diagnostics graded against a known-bad set, the tooling ring) NishiLang reads WIN on the scorecard's own measurement against the rival version named this month, and on the axes no rival has (a sovereign chain from the first byte, integer determinism, the self-healing compiler loop, eqsat behind the equivalence net) it is alone; the word superior is not written on any page until every rival axis reads WIN ref rust-releases-2026-09

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Superiority scorecard: every axis measured against every rival (LN67) after LN22	ls_scorecard	An organ composes the incumbents (nx_lang_h2h for speed with its checksum, the build lane for compile time and binary size, the Energy-Languages method for energy, the safety-class census, the graded diagnostics of LN49, the tooling-ring rows) into ONE receipt per rival per axis reading WIN LOSE TIE or UNMEASURED with the number beside each, rendered on the board and appended to a spine so the climb is a trajectory; the gate proves a planted loss cannot read WIN and an unmeasured axis cannot read TIE; PRE-DECLARED: the first receipt reads LOSE on speed, because the 2026-09-01 h2h bench measured NishiLang checked at 3.33x gcc -O2 and 1.6x Rust checked, and that number is the first bar to beat	Organ	3 u
Rival release bars as data on a beat (LN68) after LN67	ls_rival_bars	The four release pages are fetched monthly, the current versions parsed into a pinned bar row, so every WIN or LOSE names the rival version it was measured against; the gate proves a planted version change flips the bar and an unchanged page leaves it	Organ	1 u

Rung	Role	Toward	Stands on	Why
LN67	contender	lt-superior	LN22	its done-rule is a WIN row per axis per rival, the only definition of superior that is a number
LN68	substrate	lt-superior	LN67	a win against an unnamed version is a win against nobody

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Mode fit: the container's measured envelope chooses the mode (LN69) after LN67	lm_fit_mode	OPERATOR 2026-09-22 verbatim: the goal is getting the most optimal nishi language that can shift between energy efficient, speed, balance between both, and other capabilities like switching cars between races with the ai being able to use what is most effective where so its not locked in but a structured fluid like water in a container that it matches to the containers physical literal limits and needs not just one size fits all. nx_lang_modefit_lib lm_fit_mode reads the container's envelope as DATA (the tier ladder rows: cores, memory pages, thermal and energy budget, latency floor; nx_energy_probe where the host exposes RAPL) and the declared mode bundles (knowledge/lang_modes.conf), scores each bundle's measured receipt (lang.bench gains an energy column per arm: package joules per workload on hosts that expose it, UNMEASURED elsewhere) against the envelope, picks the bundle that fits, and prints the door taken and the reason (the HUD door line pattern) so a choice is never silent; a seat or an AI may override with a declared reason, never by a bare flag. Done-rule: one source built for three declared containers (a sensor-class envelope, the laptop, the NAS) yields three artefacts each inside its container's declared limits with a receipt per container, the scorecard gains an energy axis from the receipt, and the gate plants an envelope no bundle fits and proves the refusal by name	Organ	3 u

Rung	Role	Toward	Stands on	Why
LN69	contender	lt-superior	LN67	superior is not one number: it is the right shape per container, and the fit is what the rivals lack (a Rust or gcc build is one shape until a person re-flags it)

frontier (lt-fluid), dated by SB-LANG-FLUID = 2026-09 STALE. OPERATOR 2026-09-22: the language is designed from the first bit up to shift toward single-thread speed, energy efficiency, concurrency or a balance, matching the container it runs in, not one size fits all. Frontier as of this month: one sequential source whose parallel, vectorised, asynchronous and placed executions are each VERIFIED equivalent to it, with the schedule, the mapping and the scheduler all DATA the container's measured envelope chooses (LN69), so the AI or a person selects a shape by declaring it, never by rewriting the program ref arxiv-fluid-2026-09

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Serial elision by construction: every parallel construct has a sequential meaning and the compiler verifies the two agree (LN70) after LN17,LN6	se_elide	WHERE THE LANGUAGE CANNOT TODAY: parallelism is a library call (nx_pool_submit) with no sequential reading the compiler knows, so a program cannot be built single-threaded for the smallest container without a rewrite. nx_serial_elision_lib se_elide gives every parallel construct (a parallel loop, a spawned task, a sync) its sequential elision and verifies sequential-parallel equivalence on the determinism checksum the estate already demands (no floats, bit-exact), refusing by name a construct whose parallel meaning differs [arxiv-fluid-2026-09] [opencilk-site]. Done-rule: the head-to-head loop and the thread-pool workloads build serial and parallel from ONE source with identical checksums and both medians in the receipt; the gate plants a construct whose parallel meaning differs and proves the refusal	Organ	3 u
Schedule as data beside the algorithm (LN71) after LN70,LN69	sc_schedule_apply	WHERE THE LANGUAGE CANNOT TODAY: the loop shape IS the source, and the f1 and drag modes are flag bundles that elide checks, not schedules. nx_schedule_lib sc_schedule_apply reads a .schedule conf per hot loop (tile, vectorize, parallel, unroll, compute-at, the Halide vocabulary) and applies it in the compiler, never in the source; a schedule that changes a result is refused, since a schedule may only change order and locality [halide-site]. Done-rule: three schedules over the head-to-head loop, one checksum, three medians in the receipt, chosen by LN69 from the container	Organ	4 u
Effect handlers as the one seam between user code and its scheduler (LN72) after LN70	eh_handle	WHERE THE LANGUAGE CANNOT TODAY: control flow is calls and returns; there is no continuation, so sequential, asynchronous and parallel execution of the same code need three programs. nx_effect_lib eh_handle brings one-shot delimited continuations and effect handlers, so user code stays in direct style and the sequential, async and parallel schedulers are handlers written in NishiLang itself [ocaml53-effects]. Done-rule: one program run under three handlers with identical checksums; a planted second resume of a one-shot continuation is refused by name	Organ	5 u
Mapping orthogonal to correctness (LN73) after LN69,LN72	mp_map	WHERE THE LANGUAGE CANNOT TODAY: placement is wherever the code runs; there is no mapper, so a change of core, memory or door is a change of program. nx_mapper_lib mp_map decides where tasks run and where data lives from the container envelope LN69 reads, and the language guarantees a mapping decision can change timing and never a result [legion-overview]. Done-rule: two mappers over one program, identical checksums, different medians, both in the receipt	Organ	3 u
Energy is a receipt axis (LN74) after LN67	en_joules	WHERE THE LANGUAGE CANNOT TODAY: energy is not measured on any arm; the only energy evidence on this board is the field's per-language study [energy-languages]. nx_energy_receipt_lib en_joules adds package joules per arm to lang.bench on hosts that expose RAPL (nx_energy_probe) and UNMEASURED elsewhere, and the scorecard gains an energy axis per rival with an arm. Done-rule: the receipt carries joules for every arm on the laptop host and the scorecard prints the energy verdicts	Organ	2 u
Doors as lowering dialects, refusal never fallback (LN75) after LN73	dr_lower_door	WHERE THE LANGUAGE CANNOT TODAY: x86-64, rv64 and wasm are hard-coded backends; a GPU, a quantum or a photonic target has no door and no refusal, it simply cannot be named. nx_door_lower_lib dr_lower_door makes each target a declared lowering table (the MLIR dialect shape) so a new substrate is a door added as data on one source, and an absent door is a NAMED refusal [mlir-site]. Done-rule: the three live doors lower through the table byte-identically to today, and a declared-absent door (gpu, quantum, photonic) refuses by name with the rung that will open it	Organ	4 u

Rung	Role	Toward	Stands on	Why
LN70	substrate	lt-fluid	LN17,LN6	the sequential meaning is what every other shape is verified against
LN71	contender	lt-fluid	LN70,LN69	a schedule chosen per container from data is the speed shape without a rewrite
LN72	contender	lt-fluid	LN70	handlers are the concurrency shape without a second program
LN73	contender	lt-fluid	LN69,LN72	the mapper is the placement shape without a second program
LN74	substrate	lt-superior	LN67	energy cannot be a shape the container asks for until it is a number on the receipt
LN75	contender	lt-fluid	LN73	a door added as data is how quantum and photonic and our own silicon arrive without a rewrite

frontier (lt-one-language), dated by SB-LANG-ONELANG = 2026-09 STALE. OPERATOR 2026-09-22: a person must never need an add-on, a different program or another language -- the custom mathematician programs and languages exist because no language could do what they needed and Python or Java could not either -- and every scattered piece ruins sovereignty and determinacy at once, because a piece we cannot logically extend into is a third party in the path with a second semantics. Frontier as of this month: numerics, symbolic mathematics, proofs, data and query, shaders, build and notation are all written in NishiLang by extending the language from within (compile-time execution, syntax extension elaborated in the language, proofs checked in the language), one toolchain, one determinism, with Lean, Julia, Mathematica and their kind as OUTSIDE oracles only ref arxiv-onelang-2026-09

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Compile-time execution of the language itself (LN76) after LN17	ce_comptime_eval	WHERE THE LANGUAGE CANNOT TODAY: there is no compile-time execution and no staging, so anything computed at build time is either a constant somebody typed or a generator organ writing source. nx_comptime_lib ce_comptime_eval runs ordinary NishiLang at compile time (the Zig mechanism, never a macro language), deterministically on the integer lane, so tables, types and code shapes are computed by the same language that runs them [zig-overview]. Done-rule: a comptime-computed table is byte-identical to the hand-typed one it replaces across the equivalence net and self-host; the gate plants a comptime program that reads the clock or the host and proves the refusal by name	Organ	5 u
Syntax extension elaborated in the language (LN77) after LN76	sx_extend	WHERE THE LANGUAGE CANNOT TODAY: the grammar is the parser's and only the parser's; a matrix literal, a sum, a unit or a query is prose in a string or a call chain. nx_syntax_ext_lib sx_extend lets a declared notation elaborate to core NishiLang at compile time through comptime (the Racket and Lean shape), so a domain reads in its own notation and compiles through one toolchain [racket-site] [arxiv-onelang-2026-09]. Done-rule: a matrix literal and a summation notation elaborate to core code that is byte-identical to the hand-written form; a notation that elaborates differently on two hosts is refused by name	Organ	5 u
The mathematician's stack in the language (LN78) after LN76,LN77	mx_exact	WHERE THE LANGUAGE CANNOT TODAY: the estate's mathematics is a scatter of organs (bigfloat regeneration, nx_matrix_eig, nx_quadrature, nx_f64, nx_mathml, nx_mathcore) each with its own entry and none reachable as language; a person still reaches for Mathematica, Matlab or Python for exact rationals, symbolic differentiation or arbitrary precision. nx_mathstack_lib mx_exact unifies exact rationals, bigints, bigfloat, symbolic differentiation and linear algebra under LN77 notation, deterministically, with Lean and Mathlib, Julia and Mathematica as outside oracles on known answers [julia-why]. Done-rule: the KAT set the oracles agree on passes bit-exactly on both hosts, and a person writes the worked example in NishiLang notation with no other program in the path	Organ	6 u
Proofs checked in the language (LN79) after LN77	pv_check	WHERE THE LANGUAGE CANNOT TODAY: a claim about a program is prose in a comment or a gate; nothing in the language states a proposition or checks a proof. nx_proof_lib pv_check brings propositions as types with a small checked kernel so a theorem about NishiLang code is written and checked in NishiLang (the Lean shape), and Lean is the outside oracle on the same statements [arxiv-onelang-2026-09] [lean-site]. Done-rule: a planted false proof is refused by the kernel, a true one is accepted, and the same statements check in Lean	Organ	8 u
Zero add-on ratchet (LN80) after LN67	la_addon_census	WHERE THE ESTATE CANNOT TODAY: workflows still shell out to python, perl, powershell, pdftotext and curl for pieces the language lacks, and nothing counts them. nx_lang_addons_lib la_addon_census counts every foreign program a workflow, gate or plan plane forks, by name and by the language gap it stands in for, and the number may only fall (the nx_selfsuff family is the incumbent ruler and this composes it). Done-rule: the census prints the partition, names each add-on with the rung that retires it, and the ratchet refuses a rise	Organ	2 u

Rung	Role	Toward	Stands on	Why
LN76	substrate	lt-one-language	LN17	compile-time execution is the mechanism every extension stands on
LN77	contender	lt-one-language	LN76	notation elaborated in the language is what makes a domain readable without a second language
LN78	contender	lt-one-language	LN76,LN77	the mathematician's stack is the first domain the operator named
LN79	contender	lt-one-language	LN77	proofs in the language are the frontier the field reached this month
LN80	substrate	lt-one-language	LN67	the add-on count is the number that says whether the scatter is shrinking

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Whole-system receipts: a language or codegen change is accepted on the engine's number, not the loop's (LN81) after LN67	ws_whole_receipt	WHERE THE BOARD CANNOT TODAY: lang.bench measures one hot loop; a change that wins the loop and loses the LLM decode, the emitter's page time or the browser's frame would still read as a win. nx_whole_receipt_lib ws_whole_receipt composes the bench receipt reader with the engines' own timers (the nofloat decode tokens per second on the served gguf, nx_compare_regen seconds per page, the browser frame budget) so every lang rung carries the whole-system receipt beside its loop receipt, on one checksum per engine. Done-rule: the three engine receipts render beside the loop receipt on this page, and a planted change that improves the loop and regresses an engine reads LOSE on the board	Organ	3 u

Rung	Role	Toward	Stands on	Why
LN81	substrate	lt-superior	LN67	superior is measured where the operator feels it, in the whole engine, or it is a microbenchmark

frontier (lt-every-domain), dated by SB-LANG-DOMAINS = 2026-10 FRESH. OPERATOR 2026-09-26: NishiLang does what mathematicians, economists, writers and chemists want BETTER than the custom language each field built because no general language could, and it does it IN the language -- exact and symbolic mathematics, statistics and econometrics, text, chemistry and proofs are each a notation elaborated in NishiLang (LN77) over compile-time execution (LN76), graded by a KNOWN-ANSWER suite whose answers come from the field's own published tools run OUTSIDE as oracles (SymPy on Charlwood's 50, Lean's kernel, R's lm on a published dataset), and scored per rival per axis on the scorecard against the specialist columns Julia, R and Lean ref arxiv-msc-2026-09

frontier (lt-any-hardware), dated by SB-LANG-DOORS = 2026-09 ATTESTED. OPERATOR 2026-09-26: one source, every door -- a low-power sensor in a field, a laptop building websites and programs, a supercomputer, and the quantum and photonic processors -- each a lowering dialect added as data (LN75) with a known-answer test that must print the same checksum on every door it claims, the smallest door refusing by name rather than silently, and the container's measured envelope choosing the shape (LN69); the doors are declared on a ladder in data and graded on the scorecard's door axes, and no door claim is written until its census receipt exists ref arxiv-qphot-2026-09

frontier (lt-arenas), dated by SB-LANG-ARENAS = 2026-09 ATTESTED. OPERATOR 2026-09-26: the language is built for the field's arenas and graded by their referees, never by ours -- a Kaggle entry that runs and scores on a public leaderboard, DARPA-class evaluation rigor with the TRACTOR benchmark as the memory-safety translation bar, EU Cyber Resilience Act conformance from the 11 September 2026 reporting obligation, and the Asian toolchains on the rival bar; every arena receipt carries the arena's own number beside ours ref darpa-opps-rss-2026-09

Milestones

Milestone	Rungs	Cumulative
M8 · Every domain, every door, every arena (admitted 2026-09-26 from the September 2026 listings under the operator's one-language-any-hardware order)	LN82,LN83,LN84,LN85,LN86,LN87,LN88,LN89,LN90,LN91,LN92,LN93,LN94,LN95,LN96	66 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Domain known-answer suites as data with the field's tools as outside oracles (LN82) after LB0	dk_run_suite	The ruler every domain rung is graded by: knowledge/bench/domain_kat/<domain>.kat rows task-input-expected-oracle-source, the runner drives the estate organ named per row and prints pass, fail and unreachable counts that sum; the first suite is Charlwood's 50 integrals with the SymPy paper's verified answers as the oracle [sympy-charlwood-2609-25616]; today's honest first receipt is 0 of 50 reachable through nx_calc_integrate and the number is printed, never a claim; a planted wrong expected answer must fail (gate)	Organ	2 u
The mathematician's notation: exact, symbolic and unit arithmetic as syntax (LN83) after LN77,LN78	mx_notation	Exact integers and rationals (nx_bigint_lib, nx_rational), symbolic integration and series (nx_calc_integrate, nx_calc_series) and SI units (nx_units) reachable as notation elaborated in the language rather than as organs a person shells to; done-rule: the Charlwood suite (LN82) improves from its first receipt with every step printed, a unit mismatch is a compile refusal naming both units, and the arithmetic is byte-identical on every door; the bar is FloatLib's certified execution and Lean's in-language extension [floatlib-2609-19352] [garlene-2609-24345]	Organ	5 u
The economist's stack: tables, least squares and panel models in the language (LN84) after LN78	ec_ols	Tables with group-by and join, ordinary least squares, fixed-effects panel and a time-series spine as language values with integer-deterministic arithmetic; done-rule: a KAT over a published dataset reproduces R's lm coefficients to the printed tolerance with R run outside as the oracle, and the DARPA Intrinsic Market Resilience opportunity names the arena an economist's model would enter [darpa-opps-rss-2026-09] [r-sources-2026-09]	Organ	4 u
The writer's stack: sentences, tags and parses as language values (LN85) after LN77	tx_parse	The aspect lane's sovereign tagger, parser and CRF (nx_postag, nx_text_sentences, the dependency parser) reachable as language values with a notation for patterns; done-rule: a KAT over a mirrored Universal Dependencies sample with the field's tagger run outside as the oracle, accuracy printed beside the oracle's, never a claim of parity until the number says so	Organ	3 u
The chemist's stack: molecules, SMILES and units in the language (LN86) after LN77	ch_mol	The molecule graph and SMILES organs (nx_chem_molecule, nx_chem_smiles, nx_chem_smiles_emit) with nx_units as typed quantities; done-rule: a KAT over a mirrored SMILES set round-trips parse and emit and computes formula and molecular weight with RDKit run outside as the oracle, differences printed by row	Organ	3 u
The Kaggle door: a static ELF entry that reads the competition data and writes a scored submission (LN87) after LB0	kg_submit	The notebook image is Python 3.12 with gcc and no Rust, Julia or wasm runtime [kaggle-docker-python-2026-09], so the sovereign entry is a static ELF the notebook executes: a CSV and parquet reader, the model in integer arithmetic, a submission writer, and a receipt carrying the public leaderboard score beside the competition's Python baseline; done-rule: one competition entered and scored, the arena's number on the receipt	Organ	3 u
The TRACTOR arena: C to NishiLang translation graded by the DARPA benchmark's own tests (LN88) after LN3,LN4	tr_translate	DARPA's TRACTOR benchmark grades automated C-to-Rust translation with its own tests [tractor-bench-2609-25121]; the exceed candidate is translation into a language whose safety ring is declared modes (--chkarith --optenforce --ptrprov --ownership) rather than an unsafe escape hatch, with the benchmark's harness run outside as the referee; done-rule: the benchmark's pass count printed beside the published Rust translators' counts, and every refusal of the safety ring named by rule	Organ	8 u
CRA conformance receipt: SBOM, vulnerability handling and reporting evidence carried by every shipped artifact (LN89) after LR3,LR5	cra_receipt	The EU Cyber Resilience Act reporting obligation applies from 11 September 2026 [eu-cra-2026-09]; the content-addressed package lane (LR3) and the written spec (LR5) already carry the identity and the semantics, and this organ writes the receipt an artifact ships with: the closure's SBOM by content hash, the vulnerability-handling contact, the reporting path and the date each obligation applies; done-rule: a shipped artifact's receipt validates against the Act's named obligations and a receipt missing a field is refused by name	Organ	2 u
Per-category standing on the scorecard: the domain-reach, door and arena categories each print their own WIN, LOSE, TIE and UNMEASURED line (LN90) after LN67	ls_category_lines	nx_lang_scorecard counts every verdict under the @cat line it fell under and writes cat rows beside the score rows, so the crew reads the standing of one lane (Domain reach, Tooling ring, the safety ring) as one line instead of re-deriving it from 500 rows; the category count is derived from the board (no cap), and the gate proves a two-category board splits its counts exactly and a one-category board carries every row	Organ	1 u
The sensor door: a microcontroller-class lowering from the same source under the never-brick classifier (LN91) after LN75	dr_door_mcu	WHERE THE LANGUAGE CANNOT TODAY: the native doors are x86-64 and RV64; the MCU lane has kernels, a fit gate and the Rule-26 brick classifier (nx_mcu_brick) but no compiler door, so the sensor in a field is not yet a target the language can name; done-rule: an RV32 or Cortex-M lowering declared as a door (LN75) builds the door-census fixture, runs it on the simulator with the same checksum as x86-64, and every persistent-state write is classified reversible or refused by the brick classifier; LispBM's users are the bar for what a sensor program grows into [lispbm-2609-23009]	Organ	8 u
The quantum door: a hybrid quantum-classical dialect with a sovereign statevector simulator as its first target (LN92) after LN75,LN76	dr_door_quantum	WHERE THE LANGUAGE CANNOT TODAY: a quantum target has no door and no refusal; September's frontier is hybrid and dynamic -- gates as first-class values in the IR [quantum-dynamic-ir-2609-01037], Python front ends compiled to CPU, GPU and FPGA back ends for real-time error correction [quantum-backline-2609-09270], purely unitary higher-order programs [granthi-2608-20443]; done-rule: a dialect declared as data lowers a QFT and a Grover fixture to a sovereign integer-deterministic statevector simulator whose amplitudes match the field's simulator run outside as the oracle, with resource counts printed per program	Organ	8 u
The photonic door: continuous-variable semantics as a dialect lowered to a CV simulator (LN93) after LN92	dr_door_photonic	WHERE THE LANGUAGE CANNOT TODAY: photonic hardware computes in continuous variables and the estate's op-layer hedge is a bet, not a door; the field now has a formal CV semantics and a Hoare logic [cvqc-verif-2607-17714]; done-rule: a CV dialect declared as data lowers a displacement-and-squeezing fixture to a sovereign CV simulator whose moments match the field's simulator run outside as the oracle, and a program the door cannot lower is refused by name	Organ	8 u
The cluster door: multi-node placement through the mapper with a transport in the language (LN94) after LN73	mp_map_cluster	WHERE THE LANGUAGE CANNOT TODAY: the mapper (LN73) places within one box; a supercomputer is many boxes and there is no transport in the language, so a cluster is a rewrite; done-rule: the mapper places tasks across nodes over a sovereign message transport, the door-census fixture prints the same checksum on one node and on N with the speedup printed, and placement never changes the result (the Legion invariant)	Organ	8 u
The door census: one known-answer fixture built through every declared door, one receipt (LN95) after LN75	dc_run_ladder	The measurement organ for lt-any-hardware: reads the door ladder, builds the fixture through every door (x86-64, RV64, wasm32, wasm64, the MCU, GPU, quantum and photonic doors as they land), runs each on its simulator or host, and prints PASS, REFUSED-BY-NAME or ABSENT per door with the checksum; partition sums to the ladder; a door that silently degrades is a defect the census names; the doors category on the scorecard is written from this receipt and never by hand	Organ	2 u
The arXiv digest: a mirrored listing read as rows by an estate organ, never by a seat's script (LN96) after LN65	ad_digest	nx_arxiv_digest_lib ad_digest turns a mirrored Atom listing into entry rows (published, id, squashed title, categories, bounded abstract head) with an envelope naming entries, newest and oldest dates and every absence; nx_arxiv_digest is the CLI and nx_arxiv_digest_gate its referee (multi-line title, entity, pipe-in-field, missing summary, scrambled dates, cap-cut counted, non-feed UNREADABLE bite-proven); it composes the census organ's role rather than claiming completeness (population= is UNJUDGED on every envelope); built 2026-09-26 because this seat digested three listings with a laptop script, the exact add-on LN80 counts	Organ	1 u

Rung	Role	Toward	Stands on	Why
LN82	arm	lt-every-domain	LB0	the known-answer suite is the referee every domain claim is measured by; it competes for no number itself
LN83	contender	lt-every-domain	LN77,LN78	the mathematician's notation is the first domain the operator named and its KAT count is the number
LN84	contender	lt-every-domain	LN78	the economist's stack is graded against R's coefficients on a published dataset
LN85	contender	lt-every-domain	LN77	the writer's stack is graded against the field's tagger on a mirrored sample
LN86	contender	lt-every-domain	LN77	the chemist's stack is graded against RDKit on a mirrored SMILES set
LN87	contender	lt-arenas	LB0	a Kaggle leaderboard score is the arena's own number
LN88	contender	lt-arenas	LN3,LN4	the TRACTOR benchmark's pass count is DARPA's own number
LN89	arm	lt-arenas	LR3,LR5	a conformance receipt triangulates the arena without competing for a score
LN90	arm	lt-superior	LN67	a per-category line is measurement apparatus for the scorecard, not a language axis
LN91	contender	lt-any-hardware	LN75	the sensor door is the smallest container the one-source order names
LN92	contender	lt-any-hardware	LN75,LN76	the quantum door is the substrate the operator names as forward-capable
LN93	contender	lt-any-hardware	LN92	the photonic door is the second forward substrate and stands on the quantum door's dialect machinery
LN94	contender	lt-any-hardware	LN73	the cluster door is the largest container and the placement invariant is the number
LN95	arm	lt-any-hardware	LN75	the door census is the referee every door claim is measured by
LN96	arm	lt-superior	LN65	the digest is measurement apparatus for the bars every target on this board is dated by

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Pointer parameters are non-null by type; nullability is declared where null can arise and checked there (LN97) after LN2,LN90	opt_param_nonnull	The corrected checked-mode census (2026-09-26) says 8330 of 8817 counted refusals under the safety ring are the null-enforcement mode refusing a dereference of a pointer it cannot prove non-null on its path, and the locals it names (ctx 3603, c, p, lp, out, a, b, h, st, w, src, slot) are PARAMETERS the estate never null-checks because it trusts internally (rule 12); the SOTA default (Kotlin, Swift, TypeScript strict, Rust references) is the inverse: a pointer parameter is non-null BY TYPE, the caller proves it at the call site, and only a declared nullable pointer (a fallible producer's result: a lookup, a parse, a syscall that may return zero) needs the check at its use; the rung flips the mode's proof rule to that convention, keeps the current rule for declared-nullable pointers, and is graded by the census: the --optenforce refusal count over the whole population, the residue read row by row; a toolchain change through the canaried door (nx_cc_equiv_gate 10/10, self-host, canary), never a loosened checker	runtime/nx_option_enforce.nx	30 u

Rung	Role	Toward	Stands on	Why
LN97	contender	lt-typed-security	LN2,LN90	the null rule is 94 percent of the ring's distance; the mode's default cannot flip while it refuses the estate's own calling convention, and the census is the number the rung is graded by

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Packed reductions on the RV64 and wasm doors: the same OP_I64SUM lowered per door (LN19a) after LN19,LN95	x86ctx_emit_i64sum	WHERE THE LANGUAGE CANNOT TODAY: only the x86 backend lowers OP_I64SUM, so opt_vec_reduce is switched on for the native door alone (nx_compile_x86 sets the lane count; nx_nxc and nx_compile_wat leave it 0 and never meet the opcode); done-rule: nx_riscv lowers the op to a scalar loop and nx_wasm to i64x2.add over v128 loads, each driver switches the pass on, and the door census fixture plus nx_vecred_probe print the same checksums through all three doors	runtime/nx_riscv.nx	3 u
The AVX2 door for the reduction: four lanes per accumulator chosen by measured CPUID, a ladder row and never a constant (LN19b) after LN19	x86ctx_emit_i64sum_avx2	the SSE2 lowering needs no host check because SSE2 is x86-64 itself; the four-lane form (vpaddq over ymm) doubles the lane width where the host measures AVX2 (nx_cpuid) and must never be emitted where it does not, so the width is a row in knowledge/tier_ladder.conf read for the build host or dispatched at run time; the gate proves the SSE2 form is byte-identical on a host without AVX2	runtime/nx_x86_64_ctx.nx	3 u
The packed sum by name: __i64_sum(p, n) as a surface builtin lowered to OP_I64SUM (LN19c) after LN19	ir_emit_i64sum	a program that knows its loop is a reduction can ask for the packed form directly the way __i16_dot does, so a kernel author never depends on the matcher recognising a shape; done-rule: the builtin parses like __i16_dot (nx_parse.nx), the KAT sums every tail length 0..17 through it, and a door without the lowering refuses by name	runtime/nx_parse.nx	1 u
The sibling reductions: product, min, max, xor and i32 elements through the one matcher (LN19d) after LN19	opt_vec_reduce_kind	the matcher recognises one accumulate shape (i64 add); the same skeleton with the operator as data covers xor, product and the i32 element size directly, and min and max through a compare-and-select sequence (SSE2 has no packed 64-bit min or max), each with its own known-answer fixture; done-rule: nx_vecred_probe grows one case per kind and the gate reads a VECRED kind= field per rewrite	runtime/nx_opt.nx	3 u

Milestones

Milestone	Rungs	Cumulative
M9 · Testing breadth: win every published suite class or invent the test (operator standing order 2026-09-28: no sample becomes a SOTA claim; the estate race-team tests its own equipment against every published suite, every tool and the real world, and invents from mined bugs and its own intelligence where no suite exists)	LN98,LN99,LN100,LN101,LN102,LN103,LN104,LN105,LN106	43 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The regression corpus: every compiler defect becomes a test program with directives, run by one sovereign harness (LN98) after LN95	tr_lit_run	BEST IN CLASS: LLVM tests its compiler on the regression corpus under llvm/test (sized by its community in the tens of thousands of files, unmeasured here), each file a program carrying RUN lines and FileCheck patterns, run by lit, under the rule that a bugfix and a feature each add a test [llvm-testing-guide]; Kotlin's K2 is tested on an annotated corpus of programs with embedded directives and golden files reused across every target [kotlin-k2-story]; the estate has fixtures (nx_ccfold_repro.nx in the equivalence KAT, the door and reduction probes) but no corpus format, no directive language and no runner. Done-rule: nx_lit_lib reads a test program's directive lines (the door to build with, the mode flags, the expected exit, the expected stdout, a refusal that must be named), nx_lit runs a directory of them through the live and the candidate compilers and prints a partition (pass, fail, refused-as-expected, unreadable) that sums; every open compiler defect row gains one test program; the gate plants a test whose expectation is wrong and proves it fails, and one with a malformed directive and proves it is named	Organ	4 u
The golden-dump harness: an IR or assembly dump matched by a sovereign pattern checker, per optimizer pass (LN99) after LN98	tr_dumpcheck	LLVM's FileCheck matches an IR or asm dump against patterns embedded in the test (CHECK, CHECK-NEXT, CHECK-NOT) so a pass is tested by what it emits, not only by what the program prints [llvm-testing-guide]; the estate's --ir-dump prints post-opt IR and the VECRED and BCK-ELIDE lines narrate passes, but nothing matches them. Done-rule: nx_dumpcheck reads CHECK, CHECK-NEXT and CHECK-NOT lines from a test program and matches them against the compiler's stderr and the emitted assembly in order; the reduction, the elision and the closure lowerings each gain a dump test; the gate plants a CHECK-NOT that must fire and a CHECK that must fail	Organ	3 u
The random program generator: well-defined NishiLang programs from a seed, with a checksum, for differential testing across compilers and doors (LN100) after LN95,LN98	pg_generate	Csmith and YARPGen generate random programs free of undefined behaviour and compare compilers on their output, the class the field's index names [cpplinks-compilers]; the 2026 generators target IR dialects (MLIR-Smith) and cross-language compilers (CrossLangFuzzer), and CLIR fuzzes Cranelift by liveness-driven structure [arxiv-compiler-testing-2026-08]. NishiLang has no undefined arithmetic (i64 wraps, arrays are checked), so a generator that respects types and bounds by construction yields programs whose own output is the oracle. Done-rule: nx_progen emits a program from a seed (integer arithmetic, loops, fixed arrays, calls, closures, the reduction shape) that prints a checksum; nx_progen_diff builds N seeds through the live and the candidate compilers and through every door and reports a partition (agree, disagree, refused) that sums, appending each seed's verdict as it is decided. THE SEED TARGET IS DERIVED, NEVER TYPED (retracted 2026-09-28: a first cut said 10000): with zero disagreements over n seeds the per-program miscompile rate is bounded below 3/n at 95 percent confidence (the rule of three [rule-of-three]), so the comparator reads the population the candidate will compile (every .nx source under the runtime directories, counted at run time) and sets n = 3 x population, the count at which the expected number of miscompiled programs in the estate stays below one; it prints target, done and standing as a partition, and the conf row that holds the multiplier carries its calibration	Organ	6 u
The conformance corpus: one test program per specification clause, generated from the language specification (LN101) after LN98	ls_clause_tests	The Fujitsu suite organises its C, C++ and Fortran programs with reference outputs by language feature and is being folded into the LLVM test-suite [fujitsu-cts-readme]; the estate's nx_langspec declares the language but no corpus maps clauses to programs. Done-rule: every clause of the specification carries at least one test program with its expected output, the harness of LN98 runs the corpus through every door, and the coverage (clauses with a test over clauses) is printed as a partition, never a percentage without a denominator	Organ	5 u
The performance test-suite: many whole programs with reference outputs, timed and tracked per compiler generation (LN102) after LN23	tr_perf_suite	The LLVM test-suite is whole programs (SingleSource, MultiSource, MicroBenchmarks, External; 474 rows in the guide's own run) with reference output hashes, compile-time and code-size metrics, timed by timeit and tracked over versions by LNT [llvm-testsuite-guide]; the estate's head-to-head receipt is one workload. Done-rule: the receipt organ takes a directory of programs, each with its reference output, and writes one arm row per program per compiler with min and median, code size and compile time, appended per program as it is decided; the datavis emitter renders the trend per program across toolchain generations	Organ	5 u
Translation validation of every optimizer rewrite: the rewritten function proven equal to the original on the IR (LN103) after LN8,LN19	tv_validate	Alive proves LLVM peephole rewrites correct or finds counterexamples, the class the field's index names [cpplinks-compilers]; the estate's e-graph oracle (LN8) and the reduction gate's scalar-versus-packed twin are validations of one pass each. Done-rule: a validator takes the IR before and after one pass over one function and either proves equality by the e-graph under the proven rule table or produces the input on which they differ, run on every rewrite the pass count names; the gate plants a rewrite that changes wrapping order and proves the counterexample is found	Organ	8 u
Mined bug shapes: published compiler-bug corpora and the estate's own defect record become generator seeds and regression tests (LN104) after LN100	bm_mine_shapes	OPERATOR 2026-09-28: where no suite exists the estate invents and tests from its own intelligence, scraped bugs and other communities' feedback. The field mines miscompilation-bug corpora to steer generation (the Solidity miscompilation study, WhiteFox's white-box LLM-guided fuzzing, interleaved LLM compiler testing [arxiv-compiler-testing-2026-08]); the estate holds its own record (nx_debt rows, the equivalence log, the gate journals) and mirrors of the field's. Done-rule: a miner reads a bug corpus (ours first, then mirrored trackers) into shape rows (the construct, the pass, the door, the trigger) that the generator of LN100 weights and the corpus of LN98 gains a test per shape; the count of shapes covered over shapes mined is printed as a partition	Organ	5 u
Real-world corpus testing: the whole estate compiled and run by every candidate toolchain as a measured class (LN105) after LN100	tc_corpus_run	The field builds whole applications as test rows and runs published code through a candidate compiler before a release [llvm-testsuite-guide]; the estate's largest real-world corpus is itself (about 25000 sources, the self-host gauntlet, every gate). Done-rule: nx_langcensus grows a build-and-run mode over the whole population per candidate toolchain, printing built, run, exit-agreed and refused as a partition that sums, appended per source; a candidate that changes any gate's verdict is refused by name	Organ	4 u
Test reduction: a failing program shrunk to its smallest failing form by a sovereign reducer (LN106) after LN100	tr_reduce	C-Reduce shrinks a failing program while preserving the failure so a bug report is one screen, the class the field's index names [cpplinks-compilers]; the estate reduces by hand. Done-rule: nx_reduce takes a program and a predicate command, removes statements and declarations while the predicate holds, and prints the reduced program with the removal count; the gate plants a known failure and proves the reduced form still fails and is smaller	Organ	3 u

best-in-class (T-BIC-TESTING), dated by SB-TESTING = 2026-09 ATTESTED. LLVM's regression corpus (lit tests with FileCheck patterns) plus the whole-program test-suite with reference outputs, timing and LNT tracking, and the Fujitsu suite folding into it: a compiler is tested by an annotated corpus, golden dumps, whole programs and a bugfix-means-a-test rule ref llvm-testing-guide

frontier (T-FRONT-TESTING), dated by SB-TESTING = 2026-09 ATTESTED. generated and mined tests: random well-defined programs for differential testing across compilers and doors, metamorphic and mutation-consistency oracles, bug corpora steering the generator, and translation validation of every rewrite ref arxiv-compiler-testing-2026-08

Rung	Role	Toward	Stands on	Why
LN98	substrate	T-BIC-TESTING	LN95	the corpus format and runner every other class stands on
LN99	substrate	T-BIC-TESTING	LN98	golden dumps per pass, the FileCheck class
LN100	contender	T-FRONT-TESTING	LN95,LN98	a sovereign generator judged by disagreements over the derived seed target (numerator x the counted source population) against the live compiler and across doors
LN101	substrate	T-BIC-TESTING	LN98	the conformance corpus per specification clause
LN102	contender	T-BIC-TESTING	LN23	whole programs timed and tracked, the test-suite class
LN103	contender	T-FRONT-TESTING	LN8,LN19	translation validation of every rewrite
LN104	arm	T-FRONT-TESTING	LN100	mined bug shapes steering generation and the corpus
LN105	contender	T-BIC-TESTING	LN100	the real-world corpus as the release gate
LN106	substrate	T-FRONT-TESTING	LN100	the reducer every failing seed passes through
LN19a	substrate	lt-any-hardware	LN19,LN95	the reduction opcode lowered on every door
LN19b	contender	lt-peer-systems	LN19	the four-lane door against clang on the accumulate loop
LN19c	substrate	lt-peer-systems	LN19	the packed sum by name
LN19d	contender	lt-peer-systems	LN19	the sibling reductions against the LLVM vectorizers

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Causal guidance leads to an authorized correction and independently verified outcome (LN107) after LN50,LN61,codeeffectiveness:CE7	_ABSENT_:diag_guidance_verified_accept	PLANNED CONTRACT 2026-09-30. Compose existing result-action, parser/compiler, native records, PM ownership, build and recovery owners. Bind exact input/source/import/config/implementation and authority identities; explain actual versus expected behavior, cause with evidence and a permitted next action. A stale buffer, authority change, malformed optional/mandatory semantics or incomplete effect evidence cannot trigger blind replay. Exercise correct input, wrong owner, call-order defect, misleading hypothesis, stale edit, failing fix, retained capabilities and bounded rollback. The estate drives a corrected run from the returned native data, retains closure and artifact disposition, and emits matching human/machine/AI projections. No duplicate parser, diagnostic service or private JSON protocol. A source symbol or green sample alone does not satisfy this acceptance.	Workflow	unestimated u
Interactive NishiLang IDE at nishifamily.com/ide (LN108) after LN107,LN11,LN67,codeeffectiveness:CE12	_ABSENT_:nishi_ide_served_accept	FUTURE ENDPOINT; DEFERRED behind bottom-up native workflow and NishiLang qualification. Reuse the language server, compiler and shared correction contract: explain, preview a source-bound change, obtain any authority still required, apply, test the original scenario and prior capabilities, show outcome and rollback. Qualify novice task completion, keyboard/accessibility, unsaved/versioned edits and actual served interaction/visual review. No-training and approved-provider controls apply to future first- or third-party LLM adapters. A build or HTTP200 is intermediate evidence. Comparison is emitted from the existing Compare/effectiveness machinery, never a manually asserted IDE superiority claim.	Workflow	unestimated u

Rung	Role	Toward	Stands on	Why
LN107	arm	lt-peer-systems	LN50,LN61,codeeffectiveness:CE7 OPEN	guidance that leads to an authorized correction and an independently verified outcome composes the diagnostic object (LN50) and the verifier-in-the-loop door (LN61); it triangulates the diagnostics band without competing for a rival's number. PROVISIONAL placing by the cross-board lane on 2026-10-01 so the ranker stops refusing this board; the lang lane re-adjudicates
LN108	contender	lt-superior	LN107,LN11,LN67,codeeffectiveness:CE12 UNRESOLVED(no-matrix-row)	the interactive IDE is an axis of the tooling ring the superiority target names, and its rung says its comparison is emitted from the compare and effectiveness machinery rather than asserted; a contender because its done-rule is a measured standing against rival tooling. PROVISIONAL placing by the cross-board lane on 2026-10-01; the lang lane re-adjudicates

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Loop splitting for a guard bounded by a RUNTIME value: limit = smin(n, len) computed once before the loop (LN20a) after LN20	bck_irce_runtime_bound	WHERE THE LANGUAGE CANNOT TODAY: bck_irce_split admits only a CONSTANT guard bound wider than the array; the loop real programs write is while k < n with n a value the loop does not change, the case LLVM's pass exists for [llvm-irce], and there every read still pays for its check (measured 2026-09-28: a fixed array under a runtime bound keeps its bounds check in the loop); done-rule: for a guard LOAD(counter) <s n with n loop-invariant, a block before the loop computes mid = smin(n, len), the main loop runs to mid check-free and the post loop to n with its checks; the induction proof accepts the smin-built bound as at most len by construction; fixtures cover n below, equal to and above len, n zero and n negative, each trapping or returning exactly as the unsplit program; the wide-guard receipt gains a runtime-bound arm beside the rivals	Organ	5 u
Loop splitting with a pre loop: offset indexes, counters that can start below zero and descending loops (LN20b) after LN20a	bck_irce_pre_loop	WHERE THE LANGUAGE CANNOT TODAY: the split has no pre loop because every counter the induction theorem admits is proven non-negative (a non-negative constant start, non-negative constant steps), so a[k - 5], a counter that starts negative and a descending loop are refused before the splitter is asked; done-rule: the induction theorem admits an affine index and a descending counter, the split emits pre, main and post loops with the main loop check-free, and fixtures trap at exactly the first out-of-range index on BOTH sides of the array	Organ	5 u

Rung	Role	Toward	Stands on	Why
LN20a	contender	lt-peer-systems	LN20	the runtime-bound split is the case the rivals' bounds-check elimination is measured on
LN20b	contender	lt-peer-systems	LN20a	the pre loop completes the three-segment split the field ships

best-in-class (T-BIC-HAZARDS), dated by SB-HAZARDS = 2026-10 FRESH. the classes the strictest languages and verifiers already refuse: memory corruption and the null class by a strong type system (the vendor's own words after its nil outage), loops and uninitialized reads before load (the eBPF verifier), length-carrying strings and explicit conversions; NishiLang meets each as a default rather than a declared mode, with the per-class census clean over the whole estate ref cloudflare-outage-2025-12-05

frontier (T-FRONT-HAZARDS), dated by SB-HAZARDS = 2026-10 FRESH. the classes no mainstream language closes by construction and the incident record keeps charging for: deadlock and unbounded waits, leaks and unbounded resource use, loops with no termination evidence, errors dropped or turned into a panic, counters and clocks with an undeclared horizon, check-then-act on shared state, strings assembled into interpreters and retries without a budget; each becomes a refusal in the compiler or a construct the language does not have, graded per class by a census over the estate with the public record as the scoreboard, and kept current by a watch that runs with no seat ref rust-ref-not-unsafe

Milestones

Milestone	Rungs	Cumulative
M10 · Defect classes closed by construction: the earlier languages' failure classes are refused or unrepresentable and graded per class against the public incident and weakness record (operator 2026-10-03: avoid runaway resource use, infinite locks, loop issues and the other design flaws of the earlier languages; not a clone but an architecture that avoids the problems, an anti-Y2K; and the estate tracks the research itself and keeps improving without a seat, through the compare capabilities)	LN109,LN110,LN111,LN112,LN113,LN114,LN115,LN116,LN117,LN118,LN119,LN120,LN121	45 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The defect-class ledger: every class is a row with its public record and its state in the language (LN109)	hz_census	knowledge/defect_classes.conf holds one row per class (its CWE ids, its matrix row, its rung and its state: unrepresentable, refused by default, refused under a mode, detected, open) and nx_hazard_census prints the partition, joins each class to the mirrored exploited-vulnerability feed (tags in total and tags added this year) and to the Top 25 rank, and writes a gauge stamp the board renders; a class with no row, a row with no rung and a feed older than its declared cadence are each a named refusal. Done-rule: the census runs on a clock row with no seat, its partition sums to the row count, a planted class with no rung turns it RED, and the lang page shows the gauge FRESH	Organ	3 u
Resource budgets: an allocation, a queue or a retained collection carries a bound derived from its input or a declared budget (LN110) after LN109	budget_check_alloc	A table sized for 200 rows fed more than 200, and the heap exhaustion the embedded Lisp paper in the month's listing reports from real users, are one class: a size nobody derived. Under the budget mode a function that allocates in a loop or grows a collection names where its bound comes from (an input length, a conf row, a caller's budget), and exceeding it is a typed outcome the caller must consume, never a trap. Done-rule: the mode refuses an unbudgeted growth site in a fixture and accepts the derived twin, the over-limit fixture returns the typed refusal carrying the limit and the offered size, and the estate census prints budgeted, derived and unbudgeted sites as a summing partition (LN60 is the toolchain's half and stays its own rung)	Organ	5 u
Termination evidence: a loop carries a variant the compiler proves or a fuel budget it spends (LN111) after LN17,LN109	term_check_loop	The induction pass already classifies counted loops for bounds elision (LN17, LN20) and the same facts are a termination proof. Under the terminate mode a while loop whose guard the pass cannot bound must spend declared fuel, and running out is a typed outcome; the eBPF verifier refuses loops outright and the month's fixpoint paper shows a detector people trusted was unsound, so the evidence is checked and never assumed. Done-rule: every loop in the estate is censused proven, fueled or unproven as a summing partition, the mode refuses an unproven loop in a fixture, and a fueled loop that exhausts its fuel returns its outcome on the first excess iteration	Organ	4 u
Every wait has a deadline: a blocking call without one does not compile under the mode (LN112) after LN109	wait_deadline_required	Rust lists deadlocks among the behaviours it does not consider unsafe, and the estate's own outages were waits with no bound (a daemon start that slept on a registry lock for eight minutes, a slot pool wedged behind a dead holder). The stdlib's blocking calls (futex wait, lock, lease, socket read, child wait) take a deadline value, an unbounded wait is spelled never with a reason and is counted, and a deadline is derived from the resource it waits on. Done-rule: the mode refuses a blocking call with no deadline in a fixture, the census partitions every blocking site in the estate into deadline, never-with-reason and bare, and the bare count is a ratchet that only falls	Organ	3 u
Lock order by level: taking a lower lock while holding a higher one is a compile-time refusal (LN113) after LN112	lock_level_check	Deadlock by lock order is excluded for every statically named lock: each lock or lease declares a level and the compiler tracks the held set through calls; dynamic acquisition goes through try-with-deadline (LN112), so no path waits forever on an order nobody declared. Done-rule: the two-lock inversion fixture is refused naming both sites, the consistent-order twin compiles, and the estate's lock and lease sites are censused with their levels	Organ	4 u
An error is a value that must be consumed: no trapping unwrap and no silently dropped status (LN114) after LN2,LN109	mustuse_check_result	A null pointer with no error handling took a cloud control plane down and an unwrap on an error value took a proxy fleet down; both are one class, an error nobody was made to handle. A call that returns a status or an Option may not be discarded, the only way to drop one is ignore with a reason (counted), and no construct turns an error value into a trap in a non-test build. Done-rule: the mode refuses a discarded status and an unconsumed Option in fixtures, the census partitions every call site in the estate whose result is dropped, and the corpus builds unchanged with the mode off	Organ	3 u
Horizon types: a counter or a clock declares its unit and the lifetime it must survive (LN115) after LN1,LN109	horizon_check_counter	The directive names only a software counter that overflows after 248 days; that number is what a signed 32-bit count of hundredths of a second gives (2 to the 31st hundredths is 248.55 days), arithmetic nobody ran. A counter type carries its unit and maximum rate, the compiler computes the overflow horizon from the width and refuses one shorter than the declared lifetime, time values carry a unit so seconds and nanoseconds cannot be added, and the unit calculus with conversion in the month's listing is the formal bar. Done-rule: the 32-bit hundredths fixture is refused with the computed horizon in the message, the 64-bit nanosecond twin compiles with its horizon printed, a seconds-plus-nanoseconds fixture is refused, and the estate's epoch and counter sites are censused by unit and width	Organ	3 u
A check on shared state returns a token and the act must present it (LN116) after LN6,LN109	stale_check_refuse	The AWS event was a check made once at the start of a long operation and trusted at the end. A read of a shared value yields a version token, a write that depends on that read presents the token and fails when the version moved, and compare-and-swap is the only write path for a value declared shared; the estate already works this way by doctrine at its file door (an expect token on every write) and this makes it the language's rule. Done-rule: the stale-plan fixture (two writers, the slow one holding an old check) is refused at the write with both versions named, the token twin compiles and loses the race visibly, and the estate's shared-plane writers are censused by whether they carry a token	Organ	4 u
Interpreter sinks take typed builders: bytes from outside cannot reach a command, a query or a page unencoded (LN117) after LN109	sink_typed_builder	OS command injection carries more exploited-in-the-wild tags than out-of-bounds write and no memory-safe language closes it. Bytes that arrive from outside are tainted by type, a sink (process arguments, a query, markup, a path) accepts only a builder that encodes each part for that sink, and concatenating a tainted value into a sink string is refused. Done-rule: the mode refuses the concatenation fixture for each of the four sinks and accepts the builder twin, the estate's sink sites are censused builder, encoded or raw as a summing partition, and the raw count is a ratchet	Organ	5 u
Strings carry their length: the scan-to-terminator API is a named legacy class under a ratchet (LN118) after LN3,LN109	str_slice_default	The estate inherited the C convention and has paid for it once already (the 2026-07-08 read past a missing terminator, now the provenance gate's fixture). New string APIs take a checked slice, a scan that walks to a terminator is censused by site, and the count only falls. Done-rule: the stdlib string surface exists over slices with the same known answers as the pointer twins, the census prints slice sites and scan-to-terminator sites as a summing partition with the baseline recorded, and a new scan-to-terminator site in a changed file is refused by the ratchet	Organ	4 u
A retry carries a budget and jitter or it does not compile under the mode (LN119) after LN112	retry_budget_required	The recovery from the null-pointer outage was slowed by restarts with no randomized backoff, and the estate measured the same herd in its own job follower. The stdlib retry primitive takes an attempt budget, a wall-clock budget and a jittered ladder, and a hand-rolled loop that re-issues a network or lock call is refused under the mode. Done-rule: the bare retry-loop fixture is refused and the primitive twin compiles, the ladder's arithmetic is a known-answer tooth, and the estate's retry sites are censused primitive or hand-rolled	Organ	2 u
Implicit conversions are refused: every narrowing, sign change and pointer-integer crossing is spelled (LN120) after LN109	coerce_refuse_implicit	Type confusion carries 38 exploited tags and silent coercion is the scripting languages' textbook flaw. The estate writes its casts by hand already; this rung proves the compiler refuses the alternative. Done-rule: fixtures for narrowing, sign change, pointer to integer and integer to pointer without a cast are each refused naming the two types, the positive twins compile, and the gate is rostered so a parser change that admits one turns it RED	Organ	2 u
The research watch for this ladder runs with no seat: sources, seeds and proposals as data on a clock (LN121)	fs_src_applies	The frontier scanner attests every bar daily, yet it asks graphics venues about language bars (204 fetches for 12 bars, measured 2026-10-03), scans only rows where a named rival leads, and nothing runs its propose verb on a clock. Sources gain a per-board scope, a board can mark rows to watch even when no rival leads, the language venues and the weakness feeds become source rows, and propose runs daily for this board and writes a gauge stamp the page renders. Done-rule: a day passes with no seat and the board shows the proposal gauge FRESH, the attest for this board fetches only its own sources, and a planted on-subject item in a fixture listing appears as a proposal while a homonym does not	Organ	3 u

Rung	Role	Toward	Stands on	Why
LN109	substrate	T-FRONT-HAZARDS	-	the ledger and census every class rung is graded by
LN110	contender	T-FRONT-HAZARDS	LN109	unbounded resource use, which Rust's reference lists as not unsafe
LN111	contender	T-FRONT-HAZARDS	LN17,LN109	loops with no termination evidence
LN112	contender	T-FRONT-HAZARDS	LN109	unbounded waits, the deadlock class
LN113	contender	T-FRONT-HAZARDS	LN112	deadlock by lock order
LN114	contender	T-FRONT-HAZARDS	LN2,LN109	errors dropped or turned into a panic
LN115	contender	T-FRONT-HAZARDS	LN1,LN109	counters and clocks with an undeclared horizon
LN116	contender	T-FRONT-HAZARDS	LN6,LN109	check-then-act on shared state
LN117	contender	T-FRONT-HAZARDS	LN109	strings assembled into interpreters
LN118	contender	T-BIC-HAZARDS	LN3,LN109	length-carrying strings, which the strict languages already have
LN119	contender	T-FRONT-HAZARDS	LN112	retries without a budget
LN120	contender	T-BIC-HAZARDS	LN109	explicit conversions, which the strict languages already require
LN121	substrate	T-FRONT-HAZARDS	-	the watch that keeps the ledger current with no seat

Ladder verdict. LADDERED. Targets, rung roles and bars are counted in the tables below, each partition re-derived beside its total. Bars read STALE against the current month 2026-10.

Ladder verdict, counted (17 rows, more than the 12-row disclosure bar)

Ladder verdict, counted
Class	Count	Note
targets	12	sotatarget rows on the plan
best in class	3	targets whose class is best-in-class, by code
frontier	9	targets whose class is frontier, by code
undated	0	targets naming no bar that exists
bad class	0	targets whose class is neither word
duplicate	0	target ids an earlier row already carries
rungs	144	rung rows on the plan
placed	144	rungs carrying a rungrole row
unplaced	0	rungs with no role toward any target
bad role	0	rungrole rows naming a role the ladder does not know
bad target	0	rungrole rows naming a target no sotatarget row declares
rungs, summed	144	RECONCILED: the parts sum to the total 144
substrate	62	what the target's own methods consume
arm	23	a sovereign arm that triangulates without competing for the number
contender	59	its done-rule is a number against the target
superseded	0	kept as capability, retired as a claim
placed, summed	144	RECONCILED: the parts sum to the total 144

Bar freshness, counted
Class	Count	Note
bars	13	sotabar rows on the plan
fresh	3	the bar month is the current month
attested	8	an older bar with a this-month barscan reporting no newer entry
stale	2	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	13	RECONCILED: the parts sum to the total 13
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Design choices

Every design choice is a claim with its evidence beside it. A row names the choice, the error class it prevents, where it came from (research, a mined shape from the estate's own bug record, a thought leader, or the operator), the rung ids and reference keys that stand behind it, its status (adopted, proposed or retracted) and the effect it measured, or UNMEASURED. A row is refused, and says so here, when its status or source kind is outside those words or when its evidence names a key that is neither a rung on this plan nor a reference in this domain's register. The same table renders on every domain that lands design rows; the shape is shared, the rows are the board's.

Id	Choice	Error class it prevents	Source	Evidence	Status	Measured effect
LD1	Integer determinism: no floats in the sovereign lane, fixed-point everywhere	the same source computing different answers on different hosts or toolchains	operator	LN17, LN19, LN23	adopted	the served 1.5B engine runs integer kernels byte-identical across the laptop and the NAS (KAT 2026-09-16); the pos row calls it the proven exceed
LD2	Bounds-checked typed arrays with a named refusal	CWE-787 and CWE-125 out-of-bounds write and read	research	LR1, LN1	adopted	an array-bounds-violation refusal shipped in the front door and the content ruler named it as a live superset on 2026-08-21
LD3	Sum types with exhaustiveness checked by the compiler	the unhandled case, the missing else branch that compiles clean	research	LR2	adopted	UNMEASURED
LD4	Refuse first and name the rule: every refusal carries the rule that fired	a silent wrong answer, or an answer about a different subject than the one asked	operator	LN46, LN50	adopted	one plane reader's single MISS was five conditions; naming them as seven exits ended a false dead-lane filing (2026-08-21)
LD5	The verdict line is LAST and judged by position, never by text	a parser that reads the data as the answer	mined-shape	LN48, LN52	adopted	an unanchored verdict regex produced 26 GREEN and 18 RED phantom verdicts in one day (2026-08-07) before positional anchoring
LD6	A number is derived from the resource it describes, never a literal renamed into a constant	a hand-counted length beside a string drifting when the string changes	operator	LN60	adopted	13,375 value-named constants existed estate-wide before the rule (2026-09-17); the G2P and formant organs still carry them, the cost of the rename era
LD7	Every organ ships with a gate that bites a planted known-bad	the vacuous test: a check the defect cannot fail	mined-shape	LN48, LN61	adopted	nine shipping gates had fired GREEN on every run of their history (2026-08-21); that census is why the bite is mandatory
LD8	One standard library for strings, numbers, argv and files, one owner each	the duplicate ruler at the language level: every organ re-implementing print, length, parse and concatenation	mined-shape	LN9	proposed	six RIFF writers and at least eight print clones measured in one tree on 2026-09-21; a seat re-implemented the same five helpers twice that day
LD9	else-if in the surface syntax	logic hidden under nested else blocks, and a missing production that fused the following functions into the current one	mined-shape	none declared	adopted	landed in parse_stmt_if on 2026-07-29 (seq358 root cause); 43 else-if sites in the runtime tree on 2026-09-22 (nx_shelltool census, corpus_complete=1). CORRECTION 2026-09-22: this row read proposed with slices for a day because the seat's idiom memory was stale; the parser was read and the row now says what the compiler does
LD10	Ownership and pointer provenance typed against the estate's OWN mined bug shapes rather than adopted wholesale from Rust	use-after-free and provenance loss, CWE-416	research	LN2, LN6	proposed	the pos row lists these unmet on evidence rather than design; the mined shape census that would size them is LR1
LD11	Slices in the surface syntax	hand-rolled offset arithmetic, the (ptr as i64 + off) as *u8 shape the corpus writes at every byte window	mined-shape	none declared	proposed	UNMEASURED
LD12	Water in a container: one source, and the artefact takes the shape of the container it is poured into -- energy-lean, fastest, balanced, safest -- chosen by the container's MEASURED physical limits and needs, never one size fits all	a build locked to one trade-off, and a seat or an AI hand-picking flags per target	operator	LN69	proposed	the modes already exist as data (knowledge/lang_modes.conf: daily, f1, drag, checked, small, the operator's own car metaphor of 2026-09-01) and the head-to-head receipt already measures four of them on one checksum; what does not exist is the fit: nothing reads the container and chooses
LD13	Parallelism is an annotation on sequential code, verified equivalent by the compiler	a parallel program that is a different program from its serial reading, so the smallest container needs a rewrite and the largest needs a proof nobody has	research	LN70	proposed	the frontier says so this month: Exo-GPU verifies sequential-parallel equivalence and reaches over 80 percent of H100 peak; OpenCilk sells parallel as a simple extension of serial
LD14	The schedule and the mapping are data, orthogonal to correctness	a hand-tuned loop that is the only loop, and placement that is wherever the code happened to run	thought-leader	LN71, LN73	proposed	Halide separates order and locality from the algorithm; Legion guarantees a mapping decision touches performance and never correctness
LD15	Effect handlers are the one seam between direct-style user code and any scheduler	three programs for sequential, async and parallel execution of one algorithm	research	LN72	proposed	OCaml 5 wrote its schedulers in itself over one-shot continuations and kept user code in direct style
LD16	A target is a lowering dialect added as data; an absent door refuses by name	a backend hard-coded per target, and a new substrate that cannot even be named	thought-leader	LN75	proposed	MLIR exists to compile for heterogeneous hardware without a compiler per target
LD17	One language that extends into every domain from within: no add-on, no second language, no foreign runtime	a piece the language cannot logically extend into, which is a third party in the path and a second semantics at once, breaking sovereignty and determinacy together	operator	LN76, LN77, LN78, LN79, LN80	proposed	the field's proof it can be done: Julia was created because its authors needed Matlab, Lisp, Python, Ruby, Perl and Mathematica each for a piece of their work; Lean writes its extensions and proof modes in itself; Racket calls it language-oriented programming; Zig replaces the macro language with the language
LD18	Whole-stack co-design from the bit up: every layer is written in one language and designed together, so an optimisation is judged by the whole system's number, never the rung's alone	a stack of separately optimised layers whose sum is slower than a co-designed one, and a rung that wins its microbenchmark while the engine above it gets nothing	operator	LN66, LN17	adopted	the estate's measured instance: the block-native integer dot builtin was added to the language for the nofloat LLM engine's own block layout and took one decode route from 15.9 s to 142 ms per pass with identical bytes (search R0s-b, 2026-09-17), a gain no layer could have found alone; the operator's words 2026-09-22: bitmagic type stuff all the way up, where we get more out of an LLM than others because the layers are designed from the first bit and byte up to use the language and the estate together
LD19	Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate	a domain capability asserted by the presence of an organ, or graded by the seat's own reading of its output	operator	LN82, LN83, LN84, LN85, LN86	proposed	UNMEASURED
LD20	A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading	a target that is a hard-coded backend, a build that silently narrows on a small device, a supercomputer claim with no census	operator	LN91, LN92, LN93, LN94, LN95	proposed	UNMEASURED
LD21	An arena receipt carries the arena's own number beside ours: a leaderboard score, a benchmark pass count, a regulator's named obligation	a self-graded win in a field that publishes its own referee	operator	LN87, LN88, LN89	proposed	UNMEASURED
LD22	A pointer parameter is non-null by type and the caller proves it; only a declared nullable pointer carries a null check at its use	a null-enforcement mode that treats every raw pointer as maybe-null and refuses the estate's own trusting-internally convention 8330 times, or a default flipped by loosening the checker	operator	LN97, LN2, LN90	proposed	the --optenforce refusal count on the 15739-program census: 8330 today, the number this decision is graded by
LD23	memory64 is decided once, in the emitter function the board contracted (wasm_memory64), from either the toolchain door flag or the module's own declaration, and read by every address site through the one narrowing function and the one address-constant function; a shared memory under memory64 is refused by name until its helpers carry the width	silently truncated pointer -- a single address site left narrowing to i32 under a 64-bit index type compiles, runs and corrupts, which is why the decision has one home and not 27 copies (measured 2026-09-04)	research	WebAssembly memory64 (limits flag 0x04, i64 addresses, memory.grow and memory.size in the index type, i64.const segment offsets); proof nx_wasm_run_gate 28/28 under both index types with the wasm32 twin keeping its wraps, nx_wat_refuse_gate 14/14, nx_wasm_vm_memgrow_gate 21/21 (unjudged: the row was refused before its evidence was read)	REFUSED: status LANDED 2026-09-27 is not adopted, proposed or retracted	the browser door scales past the 4 GiB wall on the same source with one flag or one static; wasm32 output is unchanged by construction; the VM twin is the first host, a memory64 browser over the CDP wire is the queued oracle
LD24	a capturing function literal is a CLOSURE VALUE: a pointer to a compiler-emitted environment whose slot 0 is the code address and whose later slots hold the captured values BY VALUE, called by loading slot 0 and passing the environment first; the non-capturing literal stays a bare code address (TY_FUNC) so the six live func(...)-typed struct fields keep their ABI	silent wrong value -- a captured name that resolved to nothing (constant zero) or an environment pointer called as code; both are refused by name at the parser	research	the funcval shape of Go and the environment-passing closure conversion of Scheme and ML compilers, chosen over Rust's anonymous capture structs because this parser has no scope stack and no trait dispatch; by-value copies match the estate's no-GC, explicit-lifetime memory model; proof nx_closure_capture_gate 19/19, nx_cc_equiv_gate 10/10 + selfhost (unjudged: the row was refused before its evidence was read)	REFUSED: status LANDED 2026-09-27 is not adopted, proposed or retracted	closures exist on the native and RV64 doors with a documented ceiling (by value only, 22 arguments, no statics); the scorecard row Closures/lambdas moves from No to Yes against Rust, Go and Elm
LD25	energy per run is a second ROW KIND on the head-to-head receipt (energy: arm, uj_per_run, source, note), parsed and written by the one receipt reader and writer, rather than a 15th field on the arm row	a receipt column that every reader must know about at once (a 15-field arm row would have broken every prior receipt and every reader that counted 14) and a fabricated joule where none was measured	research	the Energy-Languages study measures RAPL package energy around each run and reports UNMEASURABLE hosts as absent, never as zero; here the source word travels with the number so a -1 is explained by the row itself (unjudged: the row was refused before its evidence was read)	REFUSED: status LANDED 2026-09-28 is not adopted, proposed or retracted	old receipts parse unchanged, the new row is additive, and the first VALID column waits for a RAPL host without a schema change
LD26	A loop idiom is replaced by one opcode the backend owns, and the pass is switched on only by a driver whose backend lowers it	a vectorizer emitting vector IR every door must understand, or a door meeting an opcode it cannot lower	mined-shape	LN19	adopted	the reduction landed as OP_I64SUM with one x86 lowering and a per-door switch on 2026-09-28; the RV64 and wasm doors never see the opcode until they lower it (LN19a)
LD27	A test budget is DERIVED from the population it protects and a cited confidence bound, printed beside its inputs on every run, never typed	a seed count typed into a note or a const: a magic number nobody can defend, fixed while the population it protects grows, and indistinguishable from a measured one on the page	REFUSED: source kind source-read is not research, mined-shape, thought-leader or operator	LN100 (unjudged: the row was refused before its evidence was read)	adopted	nx_progen_diff derives target_seeds = numerator x the distinct .nx population counted at run time from knowledge/progen.conf (the rule of three [@rule-of-three]: 3 at 950 permil), prints the derivation on the PROGEN-DIFF-TARGET line with the standing last, and refuses a conf it cannot run on by name; the 10000 a first cut typed is retracted 2026-09-28 and the generator shape knobs are conf rows marked FIXTURE-CLASS pending LN104
LD28	A transformed loop marks itself in its own IR shape, never in a side table: the post loop's guard is the same test spelled mirrored (bound >s counter), which the guard finder accepts as a guard and the splitter never takes as a candidate	a table of already-split loops keyed by block index or id: every pass that renumbers, merges or clones blocks leaves it pointing at the wrong loop, and the failure is a second split or a missed one with nothing printed	REFUSED: source kind source-read is not research, mined-shape, thought-leader or operator	LN20 (unjudged: the row was refused before its evidence was read)	adopted	bck_irce_split clones the loop and rewrites the clone's compare to the mirrored spelling, so later optimizer rounds find no counter <s bound guard on the post loop and it is never split again [@llvm-irce]; the gate's exactly-one-split teeth on F2, F6, F8 and F10 read the narration of every round, and F9 holds the other side: the counter-on-the-left form is the opposite test and is refused as a guard, bite-proven by a mutant under which an unchecked read ran
LD29	An error is a value the caller must consume and no construct turns one into a trap outside a test build	an unhandled error or a null taking a fleet down: the null pointer with no error handling at Google in June 2025 and the unwrap on an error value at Cloudflare in November 2025	mined-shape	LN114, [gcp-incident-2025-06-12], [cloudflare-outage-2025-11-18]	proposed	UNMEASURED
LD30	Every blocking call takes a deadline and never is spelled with a reason	a wait that outlives the thing it waits on: deadlock is outside what Rust calls unsafe, and the estate's own startup lock and slot-pool wedges were this class	mined-shape	LN112, LN113, [rust-ref-not-unsafe]	proposed	UNMEASURED
LD31	A size is derived from its input or a declared budget and exceeding it is a typed outcome	a limit nobody derived meeting an input nobody bounded: the 200-feature table at Cloudflare, and allocation without limits entering the Top 25	mined-shape	LN110, [cloudflare-outage-2025-11-18], [cwe-top25-2025]	proposed	UNMEASURED
LD32	A loop proves its variant or spends fuel	a loop that never ends: the kernel's verifier disallows loops before load and the month's fixpoint paper shows a trusted detector was unsound	research	LN111, [kernel-bpf-verifier], [arxiv-cspl-2026-10]	proposed	UNMEASURED
LD33	A counter or a clock declares its unit and the lifetime it must survive and the compiler does the horizon arithmetic	an overflow on a date nobody computed: the 248-day counter in the 787 generator control units	mined-shape	LN115, [faa-ad-787-248d]	proposed	UNMEASURED
LD34	A check on shared state yields a version token the later write must present	a decision made on a reading that went stale: the DNS plan written over a newer one at AWS in October 2025	mined-shape	LN116, [aws-event-2025-10-19]	proposed	UNMEASURED
LD35	Bytes from outside are tainted by type and a sink accepts only a builder that encodes for that sink	a string assembled into an interpreter: OS command injection carries 110 exploited-in-the-wild tags, more than out-of-bounds write	mined-shape	LN117, [cisa-kev-2026-10]	proposed	UNMEASURED
LD36	The language is designed against the public defect record class by class and graded per class, never by resemblance to a rival	a clone inheriting its model's blind spots: the classes a rival's own reference declares out of scope stay open in every language modelled on it	operator	LN109, [rust-ref-not-unsafe]	proposed	UNMEASURED

Design ledger verdict. REFUSED. Every design row is counted in the table below with its partition re-derived beside the total; a refused row is rendered with its rule and stays a claim nobody may cite until its data is repaired.

Design ledger verdict, counted (14 rows, more than the 12-row disclosure bar)

Design ledger verdict, counted
Class	Count	Note
rows	36	design rows on the plan
adopted	10	a choice in force
proposed	21	a choice awaiting evidence or acceptance
retracted	0	a choice withdrawn, kept as history
refused	5	a row a rule refused; the rule is rendered on the row
refused: bad status	3
refused: bad source kind	2
refused: dead evidence key	0
malformed	0	a short row
partition sum	36	RECONCILED: the parts sum to the total 36
unmeasured claims	13	rows whose claim names no measurement
evidence tokens	66	reference keys the rows cite
dead evidence tokens	0	keys that resolve to nothing in the register
rows with no evidence declared	2

Inspect a rung and its prerequisites

Declared nodes 144. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 50d39795f1aec6edce8c4efcfc6ec3a6c8ba34aa83a4f08dcaffcd0f72a59401. Target rows 12; role rows 144. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 144 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

LB0 — Self-hosted sovereign compiler
Prerequisites: None declared; this does not establish execution eligibility.
Contract: func main(argc
Acceptance: gen2 == gen3 fixpoint, equiv gate 10/10 -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB1 — Arity and param-type checks
Prerequisites: LB0 (acceptance unverified)
Contract: prepass_count_params
Acceptance: Compiler-enforced, bite-proven live -- LANDED 2026-08-05
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB2 — Match exhaustiveness
Prerequisites: LB0 (acceptance unverified)
Contract: parse_stmt_match
Acceptance: Missing and unreachable arms refused by name -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB3 — Rich diagnostics
Prerequisites: LB0 (acceptance unverified)
Contract: nx_diag_caret
Acceptance: Caret, did-you-mean, multi-error recovery -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB4 — Bounds-checked typed arrays
Prerequisites: LB0 (acceptance unverified)
Contract: NX_BOUNDS_CHECK_LIVE
Acceptance: Live checks, cost measured 2.23x -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB5 — DWARF .debug_line
Prerequisites: LB0 (acceptance unverified)
Contract: lm_stmt_stamp
Acceptance: Statement-granularity line table, readelf-validated -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB6 — Equality-saturation engine
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_eqsat_union
Acceptance: Seven gates, 93 teeth, all GREEN -- LANDED 2026-08-14
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN1 — Checked integer arithmetic
Prerequisites: LB0 (acceptance unverified)
Contract: chk_add_overflow
Acceptance: i64 add and mul trap or refuse on overflow under a declared mode (the shift-count rung already ships); gate proves an overflowing add traps and an in-range add is byte-identical to today
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN2 — Option enforcement
Prerequisites: LB1 (acceptance unverified)
Contract: opt_enforce_unwrap
Acceptance: A pointer or Option value must be unwrapped through a checked path before deref in checked mode; gate proves the sentinel-zero deref class (the recurring P2 meta-class) is refused at compile time on a fixture and the stdlib still builds
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN3 — Raw-pointer provenance
Prerequisites: LB4 (acceptance unverified)
Contract: bck_ptr_provenance
Acceptance: A raw *u8 deref carries its allocation extent where the compiler can see one (arena allocations, sys_mmap results) and is checked like typed arrays; gate proves the 2026-07-08 READ-TO-NUL over-read fixture traps
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN4 — Ownership moves
Prerequisites: LN3 (acceptance unverified)
Contract: own_check_move
Acceptance: Move semantics for owned buffers: use after move is a compile error; gate proves a fixture double-use is refused and the existing corpus builds unchanged under the default mode
Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN5 — Use-after-free prevention
Prerequisites: LN4 (acceptance unverified)
Contract: own_check_uaf
Acceptance: With LN4, a freed or released owner cannot be read; gate proves a planted UAF fixture is refused and the arena no-free doctrine is now enforced not assumed
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN6 — Data-race typing
Prerequisites: LN4 (acceptance unverified)
Contract: sync_send_check
Acceptance: Send-Sync-class marker on values crossing the thread pool; gate proves a non-Send value handed to nx_pool_submit is refused
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN7 — Backend consumes its register allocation
Prerequisites: LB0 (acceptance unverified)
Contract: x86_use_regalloc
Acceptance: The x86 emitter keeps allocated values in their registers instead of spilling to stack homes on entry (the witness: loop counter in r12, accumulator in r13, still reloaded); done-rule: nx_probe_bchk_asm shows no home reload and the checked loop bench improves, equiv net 10/10 plus self-host GREEN -- LANDED 2026-08-23 (x86_use_regalloc, nx_x86_64_ctx.nx): the homed loop counter is compared IN PLACE (movq+cmpq scratch copy removed), main() 64->60 instrs, nx_bounds_perf checked hot loop -16.5% (8278us->6912us median); SOUND cross-block forwarding (cut-the-load-block availability, self-host-proven after a merge-unsound draft was caught and rewritten); nx_x86_regalloc_use_gate 5/5 GREEN, 3/5 RED vs banked pre-LN7; equiv 10/10+selfhost GREEN; LN1/LN2/LN3/LN8 still GREEN; promoted a21068ae both roots
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN8 — Eqsat consumed by the backend
Prerequisites: LB6 (acceptance unverified)
Contract: opt_eqsat_pass
Acceptance: The pass rewrites real IR through the e-graph under the proven rule table, queued behind the equivalence net; done-rule: x xor x folds where const_fold cannot, controls hold, byte-identical on the 13,201-source population except the rewritten sites
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN9 — Canonical formatter
Prerequisites: LB0 (acceptance unverified)
Contract: srcfmt_emit
Acceptance: Idempotent formatter over the tokenizer stream; gate proves fmt(fmt(x)) == fmt(x) and the formatted corpus builds to byte-identical binaries -- SHIPPED 2026-08-23: nx_srcfmt live and registered, nx_srcfmt_gate 13/13 GREEN, style measured from the corpus, the token-stream oracle guarantees non-mutation
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN10 — Incremental build cache
Prerequisites: LB0 (acceptance unverified)
Contract: inc_cache_lookup
Acceptance: Per-module cache keyed by the closure sha the build door already computes (the B2 cache keys whole targets); gate proves a one-file edit rebuilds only its dependents and the output equals a full build
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN11 — Language server
Prerequisites: LB3 (acceptance unverified), LN9 (acceptance unverified)
Contract: lsp_serve
Acceptance: Honest greenfield (nx_lsp.nx does not exist): diagnostics, goto-def and hover over the genealogist's code graph; gate proves initialize plus a diagnostics round-trip against a recorded client transcript
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN12 — Stepping debugger
Prerequisites: LB5 (acceptance unverified)
Contract: dbg_step_over
Acceptance: The doctor lane's DT1: break and step on our own binaries over the line table we emit (one contract, two pages)
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN13 — Capturing closures
Prerequisites: LB0 (acceptance unverified)
Contract: parse_closure_capture
Acceptance: Closures capturing by value into a compiler-emitted environment struct; gate proves a captured counter increments across calls and a capture of a moved value is refused once LN4 lands
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN14 — Qualified imports
Prerequisites: LB0 (acceptance unverified)
Contract: imp_qualified_name
Acceptance: Namespace-qualified names so two organs may export the same identifier; gate proves a shadow collision from the 2026-06-23 census compiles unambiguously with qualification
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN15 — Free multi-line expressions
Prerequisites: LB0 (acceptance unverified)
Contract: tok_line_continuation
Acceptance: A continuation line opening with a binary operator joins the previous statement instead of becoming a dead statement (the det2x2 bug class); gate proves the fixture that caused the runtime-wide sweep now computes and a lone operator line is a diagnosed error
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN16 — Working f64 arithmetic
Prerequisites: LB0 (acceptance unverified)
Contract: x86ctx_emit_f64
Acceptance: Correct SSE2 emission for f64 add sub mul div; done-rule: nx_probe_float run-exit=0 (1.5 plus 1.5 equals 3.0), deliberately low priority under the no-float doctrine
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR1 — Errors as values, enforced with propagation
Prerequisites: LB1 (acceptance unverified)
Contract: res_propagate_op
Acceptance: A dropped Result refuses (must-use) and a one-character propagation form rethrows with context; abandonment stays fail-fast (the Midori split); backfill census before enforcement; witness refuse and accept both directions
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR2 — Structured concurrency: scoped spawn
Prerequisites: LB0 (acceptance unverified)
Contract: sc_scope_spawn
Acceptance: Spawn exists only inside a scope that joins its children; child error propagates to the scope; cancellation is scoped; the orphan-task shape is unrepresentable; pool witnesses stay green
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR3 — Package lane: content-addressed, zero install-time execution
Prerequisites: None declared; this does not establish execution eligibility.
Contract: pkg_cas_resolve
Acceptance: An external module resolves by content hash with no version negotiation and no code execution at install; a planted typosquat cannot resolve; the supply-chain bet becomes a measured exceed
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR4 — Language-level capability security
Prerequisites: LN4 (acceptance unverified)
Contract: cap_root_main
Acceptance: main receives root capabilities and syscall surfaces require a capability value; a dependency demanding new authority fails to compile; extends the live ocap ops surface into the type system
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR5 — Written language specification plus conformance suite
Prerequisites: None declared; this does not establish execution eligibility.
Contract: spec_conformance_run
Acceptance: The spec documents syntax, types, memory and refusal semantics; the conformance runner drives the shipped compiler over the suite and a planted deviation goes RED (the Ferrocene lesson taken early)
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR6 — NishiOS and Nishi Browser inheritance attestation
Prerequisites: LN1 (acceptance unverified), LN4 (acceptance unverified)
Contract: oa_state_name
Acceptance: The attestation organ rebuilds the nishios kernel and browser closures under the enforcing compiler (ring on, crash guard on) and writes a receipt both compare pages cite; the Rule-of-2 unsafe-language leg is discharged by measurement
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR7 — Sound bounds-check elision
Prerequisites: LN7 (acceptance unverified)
Contract: bck_elide_dominated
Acceptance: A dominated in-range re-check is elided ONLY under the blessed dominance oracle (an unsound elision is a silent memory-safety hole, the elision proof gate is the tooth); h2h checked lane approaches the unchecked band
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN17 — Induction-guarded bounds-check elision
Prerequisites: LN7 (acceptance unverified), LR7 (acceptance unverified)
Contract: bck_elide_induction
Acceptance: The loop guard proves the single check inside its loop under a fixed rule set (non-escaping local counter, constant resets, guarded constant steps, no store on a guard-to-access path, guard bound not above the array length); nx_bck_iv_gate GREEN with both refusal directions bite-proven, nx_cc_equiv_gate 10/10 plus self-host GREEN, then promote_toolchain and the receipt re-measured by the promoted compiler
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN18 — Checked arithmetic at add-plus-jo cost
Prerequisites: LN1 (acceptance unverified), LN7 (acceptance unverified)
Contract: x86ctx_ovf_fuse
Acceptance: The x86 emitter renders the LN1 overflow shape as add then jo (sub then jo, imul then jo) with no spills; nx_chkarith_gate stays GREEN, the equivalence net passes, and the receipt shows the daily mode within 1.3x of the default build on the accumulate loop
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19 — Integer SIMD reduction vectorization
Prerequisites: LN8 (acceptance unverified), LN17 (acceptance unverified)
Contract: opt_vec_reduce
Acceptance: Integer reductions with a provable trip count are emitted as packed adds under the equivalence net; the receipt shows the f1 mode within 1.2x of gcc -O2 on the accumulate loop
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN20 — Loop splitting for non-implied bounds (IRCE)
Prerequisites: LN17 (acceptance unverified)
Contract: bck_irce_split
Acceptance: A guard wider than the array yields pre, main and post loops with the main loop check-free; the F2-shaped fixture still traps at exactly the first out-of-range index
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN21 — Compiler modes as declared data
Prerequisites: LN1 (acceptance unverified), LN7 (acceptance unverified)
Contract: nxcx_expand_mode
Acceptance: Every mode is a knowledge/lang_modes.conf row expanded into declared flags; an undeclared mode refuses by name; --mode=f1 is byte-identical to its bundle (gate tooth)
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN22 — One receipt arm per mode
Prerequisites: LN21 (acceptance unverified)
Contract: h2_build_nx_mode
Acceptance: The h2h receipt carries nishilang-<mode> arms built through --mode and the page renders them beside the rival compilers; nx_lang_h2h_gate GREEN
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN23 — Energy per run on the receipt
Prerequisites: LN22 (acceptance unverified)
Contract: h2_energy_arm
Acceptance: Each arm carries package energy from RAPL or a named UNMEASURABLE; the first VALID column comes from a host that exposes powercap
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN24 — A lexer desync is attributed to the file and line that broke
Prerequisites: LB3 (acceptance unverified)
Contract: diag_desync_origin
Acceptance: A raw control byte or an unterminated string literal in the LAST user file surfaces as a flood of unknown-name errors inside the auto-appended crash handler with THAT file's line numbers (MEASURED 2026-09-02: a raw NUL inside nx_inline_vec_measure_gate.nx read as twenty errors at nx_crash.nx lines 36 to 99, and the author looked in the wrong file; the control organ nx_probe_hexesc proved high-byte hex escapes ARE honoured, so only the attribution is wrong). The lexer refuses a control byte other than tab, LF and CR by file and line, and reports an unterminated literal at ITS opening line before any later file is expanded. Gate proves a planted NUL and a planted unterminated string are each named at their own file and line, and the neg-control proves a clean corpus builds byte-identical
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN25 — Compiler capacity limits are diagnostics, not asserts
Prerequisites: LB3 (acceptance unverified)
Contract: diag_capacity_named
Acceptance: nx_cc dies with nx_assert_lt idx=4096 cap=4096 tag=ir_block_new when one function exceeds the IR block pool (MEASURED 2026-09-02: a 253-name entity if-chain in nx_html_entities.nx), naming the pool and not the function, so the author cannot tell which function to split. Every capacity cap (blocks per function, same-callee call sites, module count) is reported as an error naming the function, the cap, the measured count and the remedy. Gate proves an over-cap function is named with its count and that a function one below the cap compiles unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN26 — Line tables ride every API build so a fault address resolves on the deployed binary
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hc_build_debug_armed
Acceptance: SOURCE-LANDED 2026-09-02 (nx_hostctl cmd_buildrun), supervisor rebuild queued. MEASURED: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and the instruction to rebuild with -g; by the time anyone looked the source had moved, and nx_addr2line refused the deployed binary (no .debug_line section). The toolchain already had the whole chain (nx_cc -g emits .file/.loc, nxasm builds DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line decodes it, nx_dwline_e2e_gate runs the -g ELF) and NO build path passed the flag. Now every /api/build passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, rule 17: disarm by writing 0, no rebuild). Done when a freshly built organ answers nx_addr2line with file:line for an address inside its text on the PROMOTED binary AND the byte-identity censuses (nx_gatestale, nx_artifactdrift) treat the appended table as the like-for-like they already recognise in nx_rebuild_drain
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN27 — Every diagnostic teaches: one voice with location, caret, why and fix
Prerequisites: LB3 (acceptance unverified)
Contract: diag_voice_gate
Acceptance: The parser's teaching errors already print the offending line with a caret (nx_diag_caret), then a why-the-build-stopped line and a fix line; the LN24 desync messages landed 2026-09-02 without them and the operator named the output as not helping a programmer grow to mastery. Estate-wide: every error site in the tokenizer, parser, IR, assembler and the build door carries what, where (file:line plus caret), why and how to fix, in that one voice, and the capacity asserts (LN25) join it. A gate walks every diagnostic emission site in the toolchain sources and refuses a site that prints a location without a why line and a fix line, with the positive control of the existing teaching sites passing and a planted bare location failing. Owner: the lang lane
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN28 — SIMD lane intrinsics for the quantized decode
Prerequisites: LB3 (acceptance unverified)
Contract: x86ctx_emit_q4kunpack32s
Acceptance: LANDED 2026-09-02 on the laptop toolchain (blessed through nx_bless_compiler NEUTRAL: nx_cc_equiv_gate 10 of 10 plus self-host GREEN, nx_game_gate no-regression 127 to 127, nx_tc_canary 8 of 8). __q4k_unpack32s(qs, out, sc_lo or sc_hi shl 16) turns one Q4_K sub-block pair (32 packed nibble bytes) into 64 i16 lanes already multiplied by their 6-bit scale, emitted as 14 AVX2 instructions in VEX .byte form (vpmovzxbw, vpsrlw, vpand, vpmullw, vpbroadcastw, vmovups; the mask is built from vpcmpeqd and vpsrlw so no memory constant), five toolchain sites (nx_types OP_Q4KUNPACK32S 151, nx_ir, nx_parse, nx_x86_64_ctx, nx_x86_regalloc). Proof: nx_q4k_simd2_gate 9 of 9 -- lane-exact on 5000 random blocks against the scalar spread, dot-exact on 200 real-shaped rows against BOTH incumbent rulers, two neg-controls. The family this opens: a Q6_K unpack (the 28 fallback rows at 7B), a Q8_0 widen, and a lane-wise i16 multiply-add with the scale folded, each landing the same way. Done-rule met: the emitted unpack replaces about 1.4 scalar ops per weight and the fused dot runs 3.94x faster than the scalar-unpack SIMD dot on the 14-super-block row
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN29 — A field name must belong to the struct it is read from
Prerequisites: LB3 (acceptance unverified)
Contract: parse_field_of_struct
Acceptance: A field access p.f where f is not declared by the struct type of p is refused by name; today it resolves against every struct's field table and reads another struct's offset (measured 2026-09-02: f.name_bytes on a *Function compiled and printed junk). Gate proves the fixture is refused with the struct and its real fields named, and the corpus builds unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN30 — An else with no if is refused, never run
Prerequisites: LB3 (acceptance unverified)
Contract: parse_stmt_dangling_else
Acceptance: An else that begins a statement is refused by name with where, why and fix (measured 2026-09-02: a stray else absorbing a missing brace compiled with exit 0 and ran its block unconditionally inside nx_autofix_intake_gate, counting every row twice); gate proves the silent-class and loud-class fixtures are refused by name while else-if chains and plain if/else still compile; the corpus builds unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN31 — A keyword at module level is named, not blamed on a brace
Prerequisites: LN30 (acceptance unverified)
Contract: parse_module_stray_keyword
Acceptance: A statement keyword at module level (var, let, else, return, if, while) is refused with its own cause -- var: module state is `static name: type`; let: const or static; the rest: a function above closed early -- with where, why and fix, and parsing continues to the end gate; gate proves a module-level var is refused by name and its static twin compiles
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN32 — A bare block statement is a scope
Prerequisites: LN31 (acceptance unverified)
Contract: parse_stmt_block
Acceptance: `{ ... }` at statement start parses as a scoped block: names declared inside die at its closing brace, sibling blocks may reuse a name, a leaked name is refused by name; the block fixture runs and returns its computed value; the three estate sources written with C-style inline blocks build
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN33 — wasm threads from the sovereign compiler: shared memory, atomics, wait and notify
Prerequisites: LN6 (acceptance unverified)
Contract: wat_mem_shared
Acceptance: OPERATOR 2026-09-03 (max performance from current browsers, a launch that needs no install): the served world pages already carry COOP same-origin and COEP require-corp so SharedArrayBuffer is unlocked, and nothing spends it because the sovereign wasm backend emits no threads -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify, SharedArrayBuffer named only in a router comment. Done when nx_wasm and nx_wasm_scalararm emit a shared memory with a declared maximum plus the 0xFE-prefixed atomic loads, stores, rmw ops, wait and notify for i32 and i64, nx_compile_wat lowers them, NishiLang surfaces them as an atomic intrinsic family beside the LN6 send marker (a struct shared across Workers must be send-marked or the compiler refuses by name), and a gate instantiates the module in the sovereign VM twin AND in a browser over the CDP wire with two Workers incrementing one shared counter without loss, the neg-control being the non-atomic add that loses increments; the GE27 digest tooth then reads the threaded frame bit-identical to the single-thread frame. Consumers: gameengine GE30 (tiles across every core) and performance PF13 (the tick off the render thread)
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN34 — The same atomic names lower to hardware on the native lanes: LOCK-prefixed x86-64, rv64 AMO, futex wait and notify
Prerequisites: LN33 (acceptance unverified)
Contract: rv_home_t6
Acceptance: OPERATOR 2026-09-03 (scale from a sensor to a supercomputer, the browser is never the ceiling): the __atomic_* builtins (nx_atom.nx) lower to OP_ATOMIC_*: LOCK on x86-64 (pre-existing), 0xFE on wasm (LN33), lr/sc + AMO on rv64 (LN34 source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim and on the NAS); done when nx_x86_64 lowers nx_atomic_add32 and family to LOCK xadd, cmpxchg, xchg and mfence, the rv64 backend to amoadd, amoswap, lr and sc and fence, nx_atomic_wait32 and notify to the futex syscall on Linux and to the NishiOS kernel wait queue, all behind the SAME call names the wasm lane intercepts (one source, three lowerings), proven by a two-worker nx_pool counter that loses ZERO increments natively where the reference bodies lose some (the same lost-update neg-control the browser proof used), plus the LN6 send-marker refusing an unmarked struct shared through them
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN35 — memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling
Prerequisites: LN33 (acceptance unverified)
Contract: wasm_memory64
Acceptance: the emitter wraps every address to i32 and the WAT compiler encodes 32-bit limits, so a world larger than 65536 pages cannot exist on the browser door; done when a module declaring `static nx_wasm_memory64_req: i64 = 1` emits `(memory i64 MIN MAX)` (the memory64 limits flag), every load, store and atomic drops the i32 wrap, the mmap helper grows in i64, the WAT compiler and the VM twin carry the flag, a module past the wasm32 ceiling instantiates in a memory64 browser over the CDP wire, and a module WITHOUT the declaration still emits wasm32 byte-identical to today
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN37 — An f64 ordered compare of a single-use loaded operand is correct
Prerequisites: None declared; this does not establish execution eligibility.
Contract: x86ctx_cmp_f64_operands
Acceptance: LANDED 2026-09-03. The f64 compare emitter cleared the G1 op0-in-rax fact BEFORE the operand loads, so a G4-elided operand was re-read from a slot nothing wrote and tripped .G4_elided_slot_load_bug on any f64 ordered compare of a loaded value; the clear now happens after the ordering-key transform. Toolchain 6cf44630 canary GREEN.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN38 — A NaN operand compares unordered: every ordered predicate false, only != true
Prerequisites: LN37 (acceptance unverified)
Contract: x86ctx_emit_f64_nan_guard
Acceptance: LANDED 2026-09-03. The ordering-key transform made a NaN a total order so n != n read false and a sign-set NaN sorted below every number; an integer-only guard (exponent 2047 and mantissa nonzero, no ucomisd needed) now forces the IEEE-correct flags. Proven by nx_f64_gate 27 of 27 GREEN and bite RED against the pre-fix compiler.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN36 — Decimal exponent float literals
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lex_number_exponent
Acceptance: OPEN. lex_number in nx_tokenizer accepts a fraction and f32 or f64 suffixes but has no exponent form, so 1e-9 does not lex; today such constants are spelled in full decimals. Cheapest of the three literal gaps.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN39 — Float and f64 constant-expressions
Prerequisites: None declared; this does not establish execution eligibility.
Contract: const_eval_f64
Acceptance: OPEN. const_eval_primary in nx_parse accepts only integer literals, so const X: f64 = 0.5 is refused; today f64 module constants are written as zero-argument functions.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN40 — A large-fraction literal is refused, never looped on
Prerequisites: None declared; this does not establish execution eligibility.
Contract: fp64_from_parts_bounded
Acceptance: OPEN. A 20-digit fraction overflows the exact-rational packer in nx_quant (10 to the 20 exceeds i64) and the compiler loops instead of refusing; today tiny values like 1e-20 are built by multiplying representable literals.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN42 — nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes
Prerequisites: None declared; this does not establish execution eligibility.
Contract: axc_apply_section
Acceptance: THE BUS STOP UNDER LN36, SPECIFIED FROM THE SOURCE RATHER THAN LEFT AS A COMPLAINT. Today a writable static may only be ZERO-initialised: x86ctx_emit_module_globals emits a loud invalid line for any non-zero one because .rodata is read-only on the GNU lane and nxasm maps .data (and .bss) to section id 2 = IGNORE (axc_apply_section, nxasm_x86.nx:1051-1064). But nxasm's section 1 tail is ALREADY WRITABLE -- that is exactly how .lcomm works, and its own comment says 'zero-filled MUTABLE slot ... our single-image model appends to the data tail' -- so .data is a both-lanes-correct emission that was simply never taught. Done when: axc_apply_section maps a bare .data and .section .data to section 1; x86ctx_emit_module_globals emits .data + .Lg<id>: + a .byte list for writable non-zero globals in a SECOND pass after the rodata stream (so output stays byte-identical when no such global exists, which nx_cc_equiv_gate proves); a gate compiles a fixture with static x: i64 = 42, WRITES to x and reads it back, with a neg-control that the pre-fix compiler refuses it; and the toolchain promote is canaried. Unblocks the three organs already carrying the workaround by name (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib) and every future dual-target module
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN41 — The wasm memory is declared on the BUILD LANE so one source builds at a sensor's memory and at a supercomputer's
Prerequisites: LN33 (acceptance unverified)
Contract: watd_atoi
Acceptance: LANDED 2026-09-03. LN33 let a module declare its memory with statics; a DUAL-TARGET module cannot, because the native lane refuses a non-zero static initializer by name, and it should not have to -- a target's limit is a declared door on a ladder, never a constant in the source. nx_compile_wat --shared <pages_req> <pages_max> moves it to the build lane, --nothreads emits the unshared twin at the same declared size, and absent the flag the WAT is byte-identical. nx_wasm_threads_gate 37/37 GREEN on the NAS; driver promoted 6c6f5f4d, gate promoted 1895335d.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN43 — Bounds-check elision with a cost model
Prerequisites: LR7 (acceptance unverified)
Contract: bck_elide_cost_model
Acceptance: The modulo arm of nx_bck_elide_gate is GATED rather than merely published, elision is DECLINED on shapes that measure slower, and the div-free win is preserved at or above 1.9x across three sequential rounds on the live compiler
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN45 — An unclosed brace is reported where it was opened
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nxcx_brace_balance
Acceptance: LANDED 2026-09-03. A single missing closing brace made every later declaration parse INSIDE that block, so the module-level const on line 2 of nx_crash.nx -- the crash handler the builder APPENDS to every program -- read as an assignment and the whole cascade was attributed to a file the author never wrote. The driver now walks the TOKEN stream after lexing (so a brace inside a string or comment cannot confuse it), remembers the OUTERMOST still-open brace, and refuses with a caret on it, the depth, and the reason the errors would otherwise surface elsewhere. A stray closer gets its own message.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN44 — The build lane declares its compile mode
Prerequisites: LR7 (acceptance unverified)
Contract: cb_mode_policy
Acceptance: The mode organs are compiled with is DATA read by the build lane, not an omission; a target moved to the f1 bundle is proven output-identical by nx_behaveprobe before the move, and the published h2h receipt shows the default arm closing on the f1 arm
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN46 — Every parser refusal carries a location, a caret and a fix
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_diag_organ_at
Acceptance: LANDED 2026-09-03 (symbol repointed 2026-09-27 from the never-built name nx_pd_line to the real entry point nx_diag_organ_at in runtime/nx_parse.nx, so the contract stops reading UNMAPPED). parse_die and two sibling raw-write refusal sites printed a bare one-line sentence with no file, no line, no caret and no fix -- 35 call sites in all. nx_diag_organ_at had existed since the file-attribution pass, waiting for a line number that parse_die never had. Every token in the unit passes through advance_tok, so recording line and col at that ONE chokepoint gives every site a truthful location without touching a single call site; a site reached before any token was consumed keeps the bare form rather than pointing at line 0.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN13a — The wat lane refuses what it cannot lower
Prerequisites: LB0 (acceptance unverified)
Contract: wat_die_unlowerable
Acceptance: LANDED 2026-09-04. The precondition under LN13, and it is worth a rung on its own because it closes a silent-miscompile class that existed with no closures anywhere. The wat backend answered an IR opcode it had no arm for with a WAT COMMENT and return 0, without storing a result local, so the module assembled, instantiated and RAN while computing zero at that instruction. Only 41 of the 141 declared opcodes have an arm in that emitter and OP_CALL_INDIRECT 144 was one of the 100 that did not, which is what every function-pointer call lowers to. Done when a function-pointer call through nx_compile_wat is refused BY NAME with its opcode number and emits no module, an ordinary direct call still compiles byte-identically, and both are bound in a gate that goes RED against the pre-fix binary.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN — Board-level journal anchor for lang
Prerequisites: None declared; this does not establish execution eligibility.
Contract: -
Acceptance: BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 5 log rows against the id LN, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.
Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
autodev — Cross-domain journal anchor: autodev entries recorded on this board
Prerequisites: None declared; this does not establish execution eligibility.
Contract: -
Acceptance: DECLARED 2026-09-04 by nx_board_idref_gate. Two log rows on THIS board are addressed to the id autodev and describe work in the autodev DOMAIN, not in lang: they record nx_autofix_intake_gate going RED 3 of 5 to GREEN 5 of 5. They are also an EXACT DUPLICATE PAIR at the same epoch with identical text, which is the signature of a double-applied append rather than two findings. Declaring the anchor is additive and makes them resolvable instead of dangling; it does NOT make them correctly filed. THE OWNING LANE SHOULD RE-JOURNAL THAT FINDING ON THE AUTODEV BOARD against a real autodev rung, after which this anchor can be retired through nx_retire_path. Nothing is deleted here on purpose: history is additive and a mis-addressed record still is a record.
Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN47 — Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lc_closure_scope
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04, before the organ exists. The census resolves each program's transitive imports the way the builder does (_hdl_build/ first, then runtime/) and stamps every ERR row PROVEN or UNPROVEN by whether EVERY file in the closure is byte-identical to the estate manifest, not merely the erroring file. Done when: the organ reproduces the hand-computed partition of 2026-09-04 (135 proven, 119 unproven, 30 excluded, summing to 284) from the same two inputs, AND a planted stale import under a byte-identical leaf moves that row from PROVEN to UNPROVEN. The second half is the anti-vacuity tooth: a scoper that never demotes a row has not been shown to fire.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN48 — A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lc_expect_fail
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Every mainstream toolchain declares negative tests in the fixture -- rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck -- and the estate has no equivalent, so its compile-refusal worklist contains rows where fixing them destroys the control. Done when: a declaration field exists and the census partitions expect-fail from defect MECHANICALLY, the 7 fixtures found on 2026-09-04 by their own prose are all declared, AND at least one fixture that carries no marker phrase (z.nx and the _nxiq_ family are the known cases) is caught by the declaration and would have been missed by the vocabulary scan. That last clause exists because the 7 is a FLOOR and a mechanism that only reproduces the floor has added nothing.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN49 — Compiler diagnostics are GRADED against a known-bad fixture set, not asserted
Prerequisites: LN46 (acceptance unverified)
Contract: cc_diag_grade
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The shipping compiler already emits the three-part shape Elm set the bar for -- a caret line, a why-the-build-stopped clause and a fix clause -- and names the enclosing construct, but NONE of that is measured, so the quality claim on this board is an assertion. Done when: a fixture set of known-bad programs with expected span and expected suggestion is scored for span accuracy and suggestion correctness, the score is PUBLISHED on this page rather than claimed, and a deliberately regressed diagnostic (a refusal stripped of its caret) lowers the score. Carries its own negative control by construction.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN50 — One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_diag_object
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The same object renders through all three emitters [@gcc16] [@rustc-annotate]; a planted nested child must appear in all three; the machine sink validates against the pinned schema (LN56).
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN51 — A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal
Prerequisites: LN50 (acceptance unverified)
Contract: lc_diag_snapshot
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Snapshot per refusal over the whole census, count printed [@rustc-annotate]; a renderer that drops a nested child must show at least one differing snapshot; an identical renderer must show zero.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN52 — A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore
Prerequisites: LN48 (acceptance unverified)
Contract: lc_known_bug_id
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Parse refusal without an id [@rustc-directives] [@llvm231]; fixing the planted bug must turn the row RED; rows per class printed so zero of zero cannot read green. Extends LN48.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN53 — After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason
Prerequisites: LN47 (acceptance unverified)
Contract: lc_rebuild_partition
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Partition regressed, fixed, spurious-regressed, spurious-fixed, unchanged sums to the population [@crater159343] [@fedora45]; a planted admission refusal lands in spurious with its reason; a retry lane re-runs only changed rows.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN54 — Three optimisation passes emit certificates an independent checker accepts over the whole census
Prerequisites: None declared; this does not establish execution eligibility.
Contract: opt_pass_certificate
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Unreachable-code, dead-assignment and constant-fold certificates checked by code shared with no pass, count printed, self-host rebuild still byte-identical [@rinard10x] [@compcert318] [@brack]; a mutant that folds one constant wrongly is refused naming pass and site.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN55 — A missed-peephole candidate is scored sound and profitable on two printed axes
Prerequisites: None declared; this does not establish execution eligibility.
Contract: opt_peephole_bench
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Sound by the equivalence probe, profitable by instruction count [@peepholebench]; an unsound profitable rewrite reports REJECTED, never one of two.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN56 — Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent
Prerequisites: LN50 (acceptance unverified)
Contract: cc_diag_schema
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Schema mirrored and pinned [@sarif-tc] [@gcc-sarif-schema]; a planted malformed diagnostic is refused by field name; removing the validator yields SKIP, never GREEN.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN57 — The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator
Prerequisites: None declared; this does not establish execution eligibility.
Contract: x86_regalloc_backtrack
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Behavioural equality over a printed count of generated functions [@regalloc3]; a planted mis-assignment is caught by the fuzz lane; depends on the allocator watch x86_use_regalloc.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN58 — Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses
Prerequisites: None declared; this does not establish execution eligibility.
Contract: eqsat_bounded_acyclic
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Bound in a conf row [@egraphs2026]; the stochastic control and the bounded run agree on the census subset, counts printed; a bound of zero must be refused as vacuous.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN59 — Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane
Prerequisites: None declared; this does not establish execution eligibility.
Contract: sp_mutator_from_bug
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Each mutator names the defect row it came from [@issuemut]; a replayed mutator must reproduce its origin defect on the pre-fix binary and pass on the fixed one; prerequisite: defect rows carry their triggering input.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN60 — Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning
Prerequisites: LN49 (acceptance unverified)
Contract: count_global_tokens
Acceptance: DONE-RULE PRE-DECLARED 2026-09-05 (operator, same day: numbers need evidence on why they are set or need to be dynamic, no guessing; this belongs to the NishiLang shape and theory with research and reasoning as of September 2026). MEASURED CAUSE: parse_module derived its FUNCTION pool from counted func tokens after a 256-slot pool corrupted nxc.nx twice (T#selfhost-004/006), but kept a DECLARED 4096 for the GLOBALS pool behind a comment claiming it could not be derived -- and on 2026-09-05 the nx_wgsl unit (shader front-end + both backends + the world and cast shaders) reached 4097 and the build stopped at the guard. It CAN be derived: every global is anchored to a TK_STRING, TK_STATIC, TK_FLOAT/TK_FLOAT_F32 or TK_FUNC token, so the bound is that sum plus a NAMED slack for backend-synthesised entries, wrong only in the direction of surplus (address space never faulted in). THEORY, as of Sept 2026: a bound is a claim about the input; a claim with no witness is a guess that fails in silence when the input grows past the day it was typed, and the estate has now paid for that three times in ONE file. The language shape is therefore: (a) a pool is sized by a pass over the thing it will hold; (b) where the size is genuinely unknowable in advance (a network body), the bound is NAMED for that one purpose and its exhaustion ANNOUNCES; (c) a const that sizes anything carries, in its own comment, the measurement or the spec it came from, so a reader can re-derive it. Done when: (1) count_global_tokens lands, nx_wgsl builds past 4096 and the guard stays armed (a planted under-count refuses BY NAME, bite-proven); (2) a census organ walks the toolchain closure (nx_types, nx_lex_kinds, nx_tokenizer, nx_parse, nx_ir, nx_opt, nx_x86_64_ctx, nxasm_x86, nx_compile_x86) and lists EVERY const that sizes a pool, cap, buffer or table with a derivation class -- DERIVED-FROM-INPUT, EVIDENCED (the adjacent comment names a measurement or a published spec) or BARE -- published on this page, BARE ratcheting to zero; (3) the research is fetched, pinned and cited (candidate sources to fetch, NOT yet citations: Zig std allocator and ArrayList growth, Rust Vec amortised growth and the RFC on capacity overflow, LLVM SmallVector, the Go slice growth policy, plus the estate's own three pool incidents as the measured cost) so the principle is a written part of the NishiLang shape rather than a memory
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN61 — Verifier-in-the-loop compiler door
Prerequisites: LB0 (acceptance unverified)
Contract: vl_retry_until_green
Acceptance: The September-2026 shape for making a weak or local model produce correct programs in a language it does not know. Eiffel-tools [@eiffeltools-2609-03086] pairs a language server with a STATIC VERIFIER and retries until the program verifies, fixing 76 to 95 percent of bugs across two datasets and three models, and the verifier is what carries the correctness rather than the model. We already own the harder half: nx_cc refuses, and the gates decide. What is missing is a MACHINE-READABLE refusal plus a retry protocol a weak engine can drive without a frontier model in the loop, so that compiler refusals become a control signal instead of prose a human reads. This is the highest-leverage rung on the board because it converts all future organ authoring from frontier-token work into local work, and organ authoring is currently the frontier seat's entire residual against the 96-new-token local ceiling. Done-rule: a local engine reaches a declared first-try-green rate on a held-out organ set, measured by the incumbent nx_build_firsttry_lib and not by a new ruler.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN62 — The estate as a retrieval-time tool catalogue with a router
Prerequisites: LN61 (acceptance unverified)
Contract: tp_route_primitive
Acceptance: HEART [@heart-2609-01736] is this estate's own thesis measured by someone else, and its full text is stronger than its abstract: the backbone is Qwen3-8B, an 8B OPEN model, driving Planner, Router, Verifier and the Tool Primitives themselves, reaching 84 percent task completion on 50 real-world tasks against GPT-5.4 at 20 and Claude-4.6-Sonnet at 24, at up to 7.4 times lower API cost, and HEART on Qwen3-8B matches the GPT-5.4 hybrid on most metrics at over 12 times less cost. Two design points transfer directly. Tools are wrapped so SCHEMA RESOLUTION HAPPENS INSIDE THE TOOL rather than by enumerating raw API schemas in the caller's context, and the orchestration layer and the execution layer scale INDEPENDENTLY. We already hold the catalogue of roughly 940 registered tools, the retriever in nx_capsearch, the Verifier in the gate fleet and a Planner in nx_goalmap and nx_compare_rank. The thin part is the ROUTER and the natural-language tool wrapper. Done-rule: a local engine completes a declared task set through the router at a measured cost ratio against the frontier path, with the ratio published beside the completion rate so a cost win that loses quality is visible as a regression.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN63 — Test-time generate-evaluate-refine for organ authoring
Prerequisites: LN61 (acceptance unverified)
Contract: gc_refine_round
Acceptance: GenCorrect [@gencorrect-2609-02849] decomposes cleanly in full text and the decomposition is the argument: Nemotron-3-Nano-CC at 3B ACTIVE parameters goes 130 to 280 after SFT to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, past the 438.3 gold threshold. Post-training bought 161 points and the test-time loop bought 177, and the Ultra model gained 198 points from the loop with no code-specific RL at all. The transfer is exact: propose N organ candidates, run the GATE on each, refine from the gate's own output, repeat within a declared round budget. The estate already owns every piece except the loop itself, in nx_gate_bite and nx_sov_build_run with build-only. This is the direct answer to the 96-new-token local ceiling, because the loop trades ROUNDS for parameters rather than needing a bigger model. Done-rule: a declared organ set is authored to gate-green by a local engine within a named round budget, with the round count and the budget both published, and a neg-control organ that must NOT reach green.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN64 — A compact model-facing view of the IR
Prerequisites: LN61 (acceptance unverified)
Contract: mir_emit_compact
Acceptance: PrEx [@prex-2609-00579] settles what NOT to build here: models lean on pre-training priors rather than applying semantics handed to them, and are WORST under KeywordSwap and KeywordObf, the shifts where familiar symbol meanings must be overridden. NishiLang is exactly that case and worse, because it resembles C without matching it, so a model's priors are ACTIVELY WRONG rather than merely absent, and the failure direction is the flattering one since models frequently declare invalid programs executable. So no spec-stuffing and no fine-tuning rung will be opened on this board. What DOES transfer is representation: measured on a quantized local model, a compact control-flow representation fit the context where the AST overflowed, and REPRESENTATION CHOICE BEAT MODEL SIZE. We already have an IR. Emit a compact model-facing VIEW of it so the local ceiling rises without anyone claiming the model understands the language. Done-rule: the view is emitted from the existing IR with no second IR created, and a declared task set measures higher local first-try-green with the view than without it, the comparison run on the same engine.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN65 — Population-complete research currency, mechanically verified
Prerequisites: LB0 (acceptance unverified)
Contract: ac_census_complete
Acceptance: The sotabar and barscan law needs an attestation that a month's listing was actually READ, and until now that attestation was a seat's word. nx_arxiv_census composes the incumbents rather than duplicating them, taking se_fetch from nx_search_extern and em_int_after with em_collect_yms and em_maxym from nx_search_emerge, and asks the ONE question neither incumbent asks: does opensearch:totalResults reconcile against the entries actually delivered. Equal means the window is a POPULATION and an absence claim over it is sound; fewer means a SAMPLE wearing a population's clothes and absence over it is UNPROVEN. This is what converts the measured zero behind sb-slm-code-whitespace from an assertion into a verdict, and it also produces the barscan newest= field mechanically via em_maxym. The currency control for the agent bar is the SWE-bench listing [@arxiv-swebench-2026-09]. Done-rule: the organ exits COMPLETE on a window whose counters reconcile, CAPPED on one where max_results truncates the population, and a bite plants a deliberately truncated window that MUST be named CAPPED rather than passing.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN66 — The dot builtins lower on every door
Prerequisites: LN33 (acceptance unverified)
Contract: wat_lower_q8blkdot
Acceptance: __i16_dot and __q8blk_i16dot (OP_I16DOT, OP_Q8BLKDOT) lower only in nx_x86_64_ctx today, so a source that composes them cannot be built for the wasm or rv64 doors; the ONE SOURCE, MANY DOORS order (2026-09-03) requires a lowering on each door: nx_compile_wat lowers both ops to i16x8 and i32x4 SIMD where the profile has v128 and to a plain loop under --nothreads or a v128-less profile, the rv64 emitter lowers to a scalar loop first (the vector extension later), and the feature program _q8blkdot_minrepro.nx must exit 0 on every door it is built for. DONE-RULE: nx_cc_equiv_gate's feature leg runs the minrepro through the wat door in the estate wasm VM (nx_wasm_vm_verify) and through nx_rv64_sim with exit 0 on both, and the widest-block and most-negative-block answers are byte-identical on all three doors; a door that lacks the lowering must REFUSE the op by name at compile time, never emit a silent zero
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN67 — Superiority scorecard: every axis measured against every rival
Prerequisites: LN22 (acceptance unverified)
Contract: ls_scorecard
Acceptance: An organ composes the incumbents (nx_lang_h2h for speed with its checksum, the build lane for compile time and binary size, the Energy-Languages method for energy, the safety-class census, the graded diagnostics of LN49, the tooling-ring rows) into ONE receipt per rival per axis reading WIN LOSE TIE or UNMEASURED with the number beside each, rendered on the board and appended to a spine so the climb is a trajectory; the gate proves a planted loss cannot read WIN and an unmeasured axis cannot read TIE; PRE-DECLARED: the first receipt reads LOSE on speed, because the 2026-09-01 h2h bench measured NishiLang checked at 3.33x gcc -O2 and 1.6x Rust checked, and that number is the first bar to beat
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN68 — Rival release bars as data on a beat
Prerequisites: LN67 (acceptance unverified)
Contract: ls_rival_bars
Acceptance: The four release pages are fetched monthly, the current versions parsed into a pinned bar row, so every WIN or LOSE names the rival version it was measured against; the gate proves a planted version change flips the bar and an unchanged page leaves it
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN69 — Mode fit: the container's measured envelope chooses the mode
Prerequisites: LN67 (acceptance unverified)
Contract: lm_fit_mode
Acceptance: OPERATOR 2026-09-22 verbatim: the goal is getting the most optimal nishi language that can shift between energy efficient, speed, balance between both, and other capabilities like switching cars between races with the ai being able to use what is most effective where so its not locked in but a structured fluid like water in a container that it matches to the containers physical literal limits and needs not just one size fits all. nx_lang_modefit_lib lm_fit_mode reads the container's envelope as DATA (the tier ladder rows: cores, memory pages, thermal and energy budget, latency floor; nx_energy_probe where the host exposes RAPL) and the declared mode bundles (knowledge/lang_modes.conf), scores each bundle's measured receipt (lang.bench gains an energy column per arm: package joules per workload on hosts that expose it, UNMEASURED elsewhere) against the envelope, picks the bundle that fits, and prints the door taken and the reason (the HUD door line pattern) so a choice is never silent; a seat or an AI may override with a declared reason, never by a bare flag. Done-rule: one source built for three declared containers (a sensor-class envelope, the laptop, the NAS) yields three artefacts each inside its container's declared limits with a receipt per container, the scorecard gains an energy axis from the receipt, and the gate plants an envelope no bundle fits and proves the refusal by name
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN70 — Serial elision by construction: every parallel construct has a sequential meaning and the compiler verifies the two agree
Prerequisites: LN17 (acceptance unverified), LN6 (acceptance unverified)
Contract: se_elide
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: parallelism is a library call (nx_pool_submit) with no sequential reading the compiler knows, so a program cannot be built single-threaded for the smallest container without a rewrite. nx_serial_elision_lib se_elide gives every parallel construct (a parallel loop, a spawned task, a sync) its sequential elision and verifies sequential-parallel equivalence on the determinism checksum the estate already demands (no floats, bit-exact), refusing by name a construct whose parallel meaning differs [@arxiv-fluid-2026-09] [@opencilk-site]. Done-rule: the head-to-head loop and the thread-pool workloads build serial and parallel from ONE source with identical checksums and both medians in the receipt; the gate plants a construct whose parallel meaning differs and proves the refusal
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN71 — Schedule as data beside the algorithm
Prerequisites: LN70 (acceptance unverified), LN69 (acceptance unverified)
Contract: sc_schedule_apply
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the loop shape IS the source, and the f1 and drag modes are flag bundles that elide checks, not schedules. nx_schedule_lib sc_schedule_apply reads a .schedule conf per hot loop (tile, vectorize, parallel, unroll, compute-at, the Halide vocabulary) and applies it in the compiler, never in the source; a schedule that changes a result is refused, since a schedule may only change order and locality [@halide-site]. Done-rule: three schedules over the head-to-head loop, one checksum, three medians in the receipt, chosen by LN69 from the container
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN72 — Effect handlers as the one seam between user code and its scheduler
Prerequisites: LN70 (acceptance unverified)
Contract: eh_handle
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: control flow is calls and returns; there is no continuation, so sequential, asynchronous and parallel execution of the same code need three programs. nx_effect_lib eh_handle brings one-shot delimited continuations and effect handlers, so user code stays in direct style and the sequential, async and parallel schedulers are handlers written in NishiLang itself [@ocaml53-effects]. Done-rule: one program run under three handlers with identical checksums; a planted second resume of a one-shot continuation is refused by name
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN73 — Mapping orthogonal to correctness
Prerequisites: LN69 (acceptance unverified), LN72 (acceptance unverified)
Contract: mp_map
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: placement is wherever the code runs; there is no mapper, so a change of core, memory or door is a change of program. nx_mapper_lib mp_map decides where tasks run and where data lives from the container envelope LN69 reads, and the language guarantees a mapping decision can change timing and never a result [@legion-overview]. Done-rule: two mappers over one program, identical checksums, different medians, both in the receipt
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN74 — Energy is a receipt axis
Prerequisites: LN67 (acceptance unverified)
Contract: en_joules
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: energy is not measured on any arm; the only energy evidence on this board is the field's per-language study [@energy-languages]. nx_energy_receipt_lib en_joules adds package joules per arm to lang.bench on hosts that expose RAPL (nx_energy_probe) and UNMEASURED elsewhere, and the scorecard gains an energy axis per rival with an arm. Done-rule: the receipt carries joules for every arm on the laptop host and the scorecard prints the energy verdicts
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN75 — Doors as lowering dialects, refusal never fallback
Prerequisites: LN73 (acceptance unverified)
Contract: dr_lower_door
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: x86-64, rv64 and wasm are hard-coded backends; a GPU, a quantum or a photonic target has no door and no refusal, it simply cannot be named. nx_door_lower_lib dr_lower_door makes each target a declared lowering table (the MLIR dialect shape) so a new substrate is a door added as data on one source, and an absent door is a NAMED refusal [@mlir-site]. Done-rule: the three live doors lower through the table byte-identically to today, and a declared-absent door (gpu, quantum, photonic) refuses by name with the rung that will open it
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN76 — Compile-time execution of the language itself
Prerequisites: LN17 (acceptance unverified)
Contract: ce_comptime_eval
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: there is no compile-time execution and no staging, so anything computed at build time is either a constant somebody typed or a generator organ writing source. nx_comptime_lib ce_comptime_eval runs ordinary NishiLang at compile time (the Zig mechanism, never a macro language), deterministically on the integer lane, so tables, types and code shapes are computed by the same language that runs them [@zig-overview]. Done-rule: a comptime-computed table is byte-identical to the hand-typed one it replaces across the equivalence net and self-host; the gate plants a comptime program that reads the clock or the host and proves the refusal by name
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN77 — Syntax extension elaborated in the language
Prerequisites: LN76 (acceptance unverified)
Contract: sx_extend
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the grammar is the parser's and only the parser's; a matrix literal, a sum, a unit or a query is prose in a string or a call chain. nx_syntax_ext_lib sx_extend lets a declared notation elaborate to core NishiLang at compile time through comptime (the Racket and Lean shape), so a domain reads in its own notation and compiles through one toolchain [@racket-site] [@arxiv-onelang-2026-09]. Done-rule: a matrix literal and a summation notation elaborate to core code that is byte-identical to the hand-written form; a notation that elaborates differently on two hosts is refused by name
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN78 — The mathematician's stack in the language
Prerequisites: LN76 (acceptance unverified), LN77 (acceptance unverified)
Contract: mx_exact
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the estate's mathematics is a scatter of organs (bigfloat regeneration, nx_matrix_eig, nx_quadrature, nx_f64, nx_mathml, nx_mathcore) each with its own entry and none reachable as language; a person still reaches for Mathematica, Matlab or Python for exact rationals, symbolic differentiation or arbitrary precision. nx_mathstack_lib mx_exact unifies exact rationals, bigints, bigfloat, symbolic differentiation and linear algebra under LN77 notation, deterministically, with Lean and Mathlib, Julia and Mathematica as outside oracles on known answers [@julia-why]. Done-rule: the KAT set the oracles agree on passes bit-exactly on both hosts, and a person writes the worked example in NishiLang notation with no other program in the path
Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN79 — Proofs checked in the language
Prerequisites: LN77 (acceptance unverified)
Contract: pv_check
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: a claim about a program is prose in a comment or a gate; nothing in the language states a proposition or checks a proof. nx_proof_lib pv_check brings propositions as types with a small checked kernel so a theorem about NishiLang code is written and checked in NishiLang (the Lean shape), and Lean is the outside oracle on the same statements [@arxiv-onelang-2026-09] [@lean-site]. Done-rule: a planted false proof is refused by the kernel, a true one is accepted, and the same statements check in Lean
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN80 — Zero add-on ratchet
Prerequisites: LN67 (acceptance unverified)
Contract: la_addon_census
Acceptance: WHERE THE ESTATE CANNOT TODAY: workflows still shell out to python, perl, powershell, pdftotext and curl for pieces the language lacks, and nothing counts them. nx_lang_addons_lib la_addon_census counts every foreign program a workflow, gate or plan plane forks, by name and by the language gap it stands in for, and the number may only fall (the nx_selfsuff family is the incumbent ruler and this composes it). Done-rule: the census prints the partition, names each add-on with the rung that retires it, and the ratchet refuses a rise
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN81 — Whole-system receipts: a language or codegen change is accepted on the engine's number, not the loop's
Prerequisites: LN67 (acceptance unverified)
Contract: ws_whole_receipt
Acceptance: WHERE THE BOARD CANNOT TODAY: lang.bench measures one hot loop; a change that wins the loop and loses the LLM decode, the emitter's page time or the browser's frame would still read as a win. nx_whole_receipt_lib ws_whole_receipt composes the bench receipt reader with the engines' own timers (the nofloat decode tokens per second on the served gguf, nx_compare_regen seconds per page, the browser frame budget) so every lang rung carries the whole-system receipt beside its loop receipt, on one checksum per engine. Done-rule: the three engine receipts render beside the loop receipt on this page, and a planted change that improves the loop and regresses an engine reads LOSE on the board
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN82 — Domain known-answer suites as data with the field's tools as outside oracles
Prerequisites: LB0 (acceptance unverified)
Contract: dk_run_suite
Acceptance: The ruler every domain rung is graded by: knowledge/bench/domain_kat/<domain>.kat rows task-input-expected-oracle-source, the runner drives the estate organ named per row and prints pass, fail and unreachable counts that sum; the first suite is Charlwood's 50 integrals with the SymPy paper's verified answers as the oracle [@sympy-charlwood-2609-25616]; today's honest first receipt is 0 of 50 reachable through nx_calc_integrate and the number is printed, never a claim; a planted wrong expected answer must fail (gate)
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN83 — The mathematician's notation: exact, symbolic and unit arithmetic as syntax
Prerequisites: LN77 (acceptance unverified), LN78 (acceptance unverified)
Contract: mx_notation
Acceptance: Exact integers and rationals (nx_bigint_lib, nx_rational), symbolic integration and series (nx_calc_integrate, nx_calc_series) and SI units (nx_units) reachable as notation elaborated in the language rather than as organs a person shells to; done-rule: the Charlwood suite (LN82) improves from its first receipt with every step printed, a unit mismatch is a compile refusal naming both units, and the arithmetic is byte-identical on every door; the bar is FloatLib's certified execution and Lean's in-language extension [@floatlib-2609-19352] [@garlene-2609-24345]
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN84 — The economist's stack: tables, least squares and panel models in the language
Prerequisites: LN78 (acceptance unverified)
Contract: ec_ols
Acceptance: Tables with group-by and join, ordinary least squares, fixed-effects panel and a time-series spine as language values with integer-deterministic arithmetic; done-rule: a KAT over a published dataset reproduces R's lm coefficients to the printed tolerance with R run outside as the oracle, and the DARPA Intrinsic Market Resilience opportunity names the arena an economist's model would enter [@darpa-opps-rss-2026-09] [@r-sources-2026-09]
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN85 — The writer's stack: sentences, tags and parses as language values
Prerequisites: LN77 (acceptance unverified)
Contract: tx_parse
Acceptance: The aspect lane's sovereign tagger, parser and CRF (nx_postag, nx_text_sentences, the dependency parser) reachable as language values with a notation for patterns; done-rule: a KAT over a mirrored Universal Dependencies sample with the field's tagger run outside as the oracle, accuracy printed beside the oracle's, never a claim of parity until the number says so
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN86 — The chemist's stack: molecules, SMILES and units in the language
Prerequisites: LN77 (acceptance unverified)
Contract: ch_mol
Acceptance: The molecule graph and SMILES organs (nx_chem_molecule, nx_chem_smiles, nx_chem_smiles_emit) with nx_units as typed quantities; done-rule: a KAT over a mirrored SMILES set round-trips parse and emit and computes formula and molecular weight with RDKit run outside as the oracle, differences printed by row
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN87 — The Kaggle door: a static ELF entry that reads the competition data and writes a scored submission
Prerequisites: LB0 (acceptance unverified)
Contract: kg_submit
Acceptance: The notebook image is Python 3.12 with gcc and no Rust, Julia or wasm runtime [@kaggle-docker-python-2026-09], so the sovereign entry is a static ELF the notebook executes: a CSV and parquet reader, the model in integer arithmetic, a submission writer, and a receipt carrying the public leaderboard score beside the competition's Python baseline; done-rule: one competition entered and scored, the arena's number on the receipt
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN88 — The TRACTOR arena: C to NishiLang translation graded by the DARPA benchmark's own tests
Prerequisites: LN3 (acceptance unverified), LN4 (acceptance unverified)
Contract: tr_translate
Acceptance: DARPA's TRACTOR benchmark grades automated C-to-Rust translation with its own tests [@tractor-bench-2609-25121]; the exceed candidate is translation into a language whose safety ring is declared modes (--chkarith --optenforce --ptrprov --ownership) rather than an unsafe escape hatch, with the benchmark's harness run outside as the referee; done-rule: the benchmark's pass count printed beside the published Rust translators' counts, and every refusal of the safety ring named by rule
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN89 — CRA conformance receipt: SBOM, vulnerability handling and reporting evidence carried by every shipped artifact
Prerequisites: LR3 (acceptance unverified), LR5 (acceptance unverified)
Contract: cra_receipt
Acceptance: The EU Cyber Resilience Act reporting obligation applies from 11 September 2026 [@eu-cra-2026-09]; the content-addressed package lane (LR3) and the written spec (LR5) already carry the identity and the semantics, and this organ writes the receipt an artifact ships with: the closure's SBOM by content hash, the vulnerability-handling contact, the reporting path and the date each obligation applies; done-rule: a shipped artifact's receipt validates against the Act's named obligations and a receipt missing a field is refused by name
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN90 — Per-category standing on the scorecard: the domain-reach, door and arena categories each print their own WIN, LOSE, TIE and UNMEASURED line
Prerequisites: LN67 (acceptance unverified)
Contract: ls_category_lines
Acceptance: nx_lang_scorecard counts every verdict under the @cat line it fell under and writes cat rows beside the score rows, so the crew reads the standing of one lane (Domain reach, Tooling ring, the safety ring) as one line instead of re-deriving it from 500 rows; the category count is derived from the board (no cap), and the gate proves a two-category board splits its counts exactly and a one-category board carries every row
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN91 — The sensor door: a microcontroller-class lowering from the same source under the never-brick classifier
Prerequisites: LN75 (acceptance unverified)
Contract: dr_door_mcu
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the native doors are x86-64 and RV64; the MCU lane has kernels, a fit gate and the Rule-26 brick classifier (nx_mcu_brick) but no compiler door, so the sensor in a field is not yet a target the language can name; done-rule: an RV32 or Cortex-M lowering declared as a door (LN75) builds the door-census fixture, runs it on the simulator with the same checksum as x86-64, and every persistent-state write is classified reversible or refused by the brick classifier; LispBM's users are the bar for what a sensor program grows into [@lispbm-2609-23009]
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN92 — The quantum door: a hybrid quantum-classical dialect with a sovereign statevector simulator as its first target
Prerequisites: LN75 (acceptance unverified), LN76 (acceptance unverified)
Contract: dr_door_quantum
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: a quantum target has no door and no refusal; September's frontier is hybrid and dynamic -- gates as first-class values in the IR [@quantum-dynamic-ir-2609-01037], Python front ends compiled to CPU, GPU and FPGA back ends for real-time error correction [@quantum-backline-2609-09270], purely unitary higher-order programs [@granthi-2608-20443]; done-rule: a dialect declared as data lowers a QFT and a Grover fixture to a sovereign integer-deterministic statevector simulator whose amplitudes match the field's simulator run outside as the oracle, with resource counts printed per program
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN93 — The photonic door: continuous-variable semantics as a dialect lowered to a CV simulator
Prerequisites: LN92 (acceptance unverified)
Contract: dr_door_photonic
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: photonic hardware computes in continuous variables and the estate's op-layer hedge is a bet, not a door; the field now has a formal CV semantics and a Hoare logic [@cvqc-verif-2607-17714]; done-rule: a CV dialect declared as data lowers a displacement-and-squeezing fixture to a sovereign CV simulator whose moments match the field's simulator run outside as the oracle, and a program the door cannot lower is refused by name
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN94 — The cluster door: multi-node placement through the mapper with a transport in the language
Prerequisites: LN73 (acceptance unverified)
Contract: mp_map_cluster
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the mapper (LN73) places within one box; a supercomputer is many boxes and there is no transport in the language, so a cluster is a rewrite; done-rule: the mapper places tasks across nodes over a sovereign message transport, the door-census fixture prints the same checksum on one node and on N with the speedup printed, and placement never changes the result (the Legion invariant)
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN95 — The door census: one known-answer fixture built through every declared door, one receipt
Prerequisites: LN75 (acceptance unverified)
Contract: dc_run_ladder
Acceptance: The measurement organ for lt-any-hardware: reads the door ladder, builds the fixture through every door (x86-64, RV64, wasm32, wasm64, the MCU, GPU, quantum and photonic doors as they land), runs each on its simulator or host, and prints PASS, REFUSED-BY-NAME or ABSENT per door with the checksum; partition sums to the ladder; a door that silently degrades is a defect the census names; the doors category on the scorecard is written from this receipt and never by hand
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN96 — The arXiv digest: a mirrored listing read as rows by an estate organ, never by a seat's script
Prerequisites: LN65 (acceptance unverified)
Contract: ad_digest
Acceptance: nx_arxiv_digest_lib ad_digest turns a mirrored Atom listing into entry rows (published, id, squashed title, categories, bounded abstract head) with an envelope naming entries, newest and oldest dates and every absence; nx_arxiv_digest is the CLI and nx_arxiv_digest_gate its referee (multi-line title, entity, pipe-in-field, missing summary, scrambled dates, cap-cut counted, non-feed UNREADABLE bite-proven); it composes the census organ's role rather than claiming completeness (population= is UNJUDGED on every envelope); built 2026-09-26 because this seat digested three listings with a laptop script, the exact add-on LN80 counts
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN97 — Pointer parameters are non-null by type; nullability is declared where null can arise and checked there
Prerequisites: LN2 (acceptance unverified), LN90 (acceptance unverified)
Contract: opt_param_nonnull
Acceptance: The corrected checked-mode census (2026-09-26) says 8330 of 8817 counted refusals under the safety ring are the null-enforcement mode refusing a dereference of a pointer it cannot prove non-null on its path, and the locals it names (ctx 3603, c, p, lp, out, a, b, h, st, w, src, slot) are PARAMETERS the estate never null-checks because it trusts internally (rule 12); the SOTA default (Kotlin, Swift, TypeScript strict, Rust references) is the inverse: a pointer parameter is non-null BY TYPE, the caller proves it at the call site, and only a declared nullable pointer (a fallible producer's result: a lookup, a parse, a syscall that may return zero) needs the check at its use; the rung flips the mode's proof rule to that convention, keeps the current rule for declared-nullable pointers, and is graded by the census: the --optenforce refusal count over the whole population, the residue read row by row; a toolchain change through the canaried door (nx_cc_equiv_gate 10/10, self-host, canary), never a loosened checker
Authored effort: 30. Executor kind: runtime/nx_option_enforce.nx. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19a — Packed reductions on the RV64 and wasm doors: the same OP_I64SUM lowered per door
Prerequisites: LN19 (acceptance unverified), LN95 (acceptance unverified)
Contract: x86ctx_emit_i64sum
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: only the x86 backend lowers OP_I64SUM, so opt_vec_reduce is switched on for the native door alone (nx_compile_x86 sets the lane count; nx_nxc and nx_compile_wat leave it 0 and never meet the opcode); done-rule: nx_riscv lowers the op to a scalar loop and nx_wasm to i64x2.add over v128 loads, each driver switches the pass on, and the door census fixture plus nx_vecred_probe print the same checksums through all three doors
Authored effort: 3. Executor kind: runtime/nx_riscv.nx. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19b — The AVX2 door for the reduction: four lanes per accumulator chosen by measured CPUID, a ladder row and never a constant
Prerequisites: LN19 (acceptance unverified)
Contract: x86ctx_emit_i64sum_avx2
Acceptance: the SSE2 lowering needs no host check because SSE2 is x86-64 itself; the four-lane form (vpaddq over ymm) doubles the lane width where the host measures AVX2 (nx_cpuid) and must never be emitted where it does not, so the width is a row in knowledge/tier_ladder.conf read for the build host or dispatched at run time; the gate proves the SSE2 form is byte-identical on a host without AVX2
Authored effort: 3. Executor kind: runtime/nx_x86_64_ctx.nx. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19c — The packed sum by name: __i64_sum(p, n) as a surface builtin lowered to OP_I64SUM
Prerequisites: LN19 (acceptance unverified)
Contract: ir_emit_i64sum
Acceptance: a program that knows its loop is a reduction can ask for the packed form directly the way __i16_dot does, so a kernel author never depends on the matcher recognising a shape; done-rule: the builtin parses like __i16_dot (nx_parse.nx), the KAT sums every tail length 0..17 through it, and a door without the lowering refuses by name
Authored effort: 1. Executor kind: runtime/nx_parse.nx. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19d — The sibling reductions: product, min, max, xor and i32 elements through the one matcher
Prerequisites: LN19 (acceptance unverified)
Contract: opt_vec_reduce_kind
Acceptance: the matcher recognises one accumulate shape (i64 add); the same skeleton with the operator as data covers xor, product and the i32 element size directly, and min and max through a compare-and-select sequence (SSE2 has no packed 64-bit min or max), each with its own known-answer fixture; done-rule: nx_vecred_probe grows one case per kind and the gate reads a VECRED kind= field per rewrite
Authored effort: 3. Executor kind: runtime/nx_opt.nx. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN98 — The regression corpus: every compiler defect becomes a test program with directives, run by one sovereign harness
Prerequisites: LN95 (acceptance unverified)
Contract: tr_lit_run
Acceptance: BEST IN CLASS: LLVM tests its compiler on the regression corpus under llvm/test (sized by its community in the tens of thousands of files, unmeasured here), each file a program carrying RUN lines and FileCheck patterns, run by lit, under the rule that a bugfix and a feature each add a test [@llvm-testing-guide]; Kotlin's K2 is tested on an annotated corpus of programs with embedded directives and golden files reused across every target [@kotlin-k2-story]; the estate has fixtures (nx_ccfold_repro.nx in the equivalence KAT, the door and reduction probes) but no corpus format, no directive language and no runner. Done-rule: nx_lit_lib reads a test program's directive lines (the door to build with, the mode flags, the expected exit, the expected stdout, a refusal that must be named), nx_lit runs a directory of them through the live and the candidate compilers and prints a partition (pass, fail, refused-as-expected, unreadable) that sums; every open compiler defect row gains one test program; the gate plants a test whose expectation is wrong and proves it fails, and one with a malformed directive and proves it is named
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN99 — The golden-dump harness: an IR or assembly dump matched by a sovereign pattern checker, per optimizer pass
Prerequisites: LN98 (acceptance unverified)
Contract: tr_dumpcheck
Acceptance: LLVM's FileCheck matches an IR or asm dump against patterns embedded in the test (CHECK, CHECK-NEXT, CHECK-NOT) so a pass is tested by what it emits, not only by what the program prints [@llvm-testing-guide]; the estate's --ir-dump prints post-opt IR and the VECRED and BCK-ELIDE lines narrate passes, but nothing matches them. Done-rule: nx_dumpcheck reads CHECK, CHECK-NEXT and CHECK-NOT lines from a test program and matches them against the compiler's stderr and the emitted assembly in order; the reduction, the elision and the closure lowerings each gain a dump test; the gate plants a CHECK-NOT that must fire and a CHECK that must fail
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN100 — The random program generator: well-defined NishiLang programs from a seed, with a checksum, for differential testing across compilers and doors
Prerequisites: LN95 (acceptance unverified), LN98 (acceptance unverified)
Contract: pg_generate
Acceptance: Csmith and YARPGen generate random programs free of undefined behaviour and compare compilers on their output, the class the field's index names [@cpplinks-compilers]; the 2026 generators target IR dialects (MLIR-Smith) and cross-language compilers (CrossLangFuzzer), and CLIR fuzzes Cranelift by liveness-driven structure [@arxiv-compiler-testing-2026-08]. NishiLang has no undefined arithmetic (i64 wraps, arrays are checked), so a generator that respects types and bounds by construction yields programs whose own output is the oracle. Done-rule: nx_progen emits a program from a seed (integer arithmetic, loops, fixed arrays, calls, closures, the reduction shape) that prints a checksum; nx_progen_diff builds N seeds through the live and the candidate compilers and through every door and reports a partition (agree, disagree, refused) that sums, appending each seed's verdict as it is decided. THE SEED TARGET IS DERIVED, NEVER TYPED (retracted 2026-09-28: a first cut said 10000): with zero disagreements over n seeds the per-program miscompile rate is bounded below 3/n at 95 percent confidence (the rule of three [@rule-of-three]), so the comparator reads the population the candidate will compile (every .nx source under the runtime directories, counted at run time) and sets n = 3 x population, the count at which the expected number of miscompiled programs in the estate stays below one; it prints target, done and standing as a partition, and the conf row that holds the multiplier carries its calibration
Authored effort: 6. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN101 — The conformance corpus: one test program per specification clause, generated from the language specification
Prerequisites: LN98 (acceptance unverified)
Contract: ls_clause_tests
Acceptance: The Fujitsu suite organises its C, C++ and Fortran programs with reference outputs by language feature and is being folded into the LLVM test-suite [@fujitsu-cts-readme]; the estate's nx_langspec declares the language but no corpus maps clauses to programs. Done-rule: every clause of the specification carries at least one test program with its expected output, the harness of LN98 runs the corpus through every door, and the coverage (clauses with a test over clauses) is printed as a partition, never a percentage without a denominator
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN102 — The performance test-suite: many whole programs with reference outputs, timed and tracked per compiler generation
Prerequisites: LN23 (acceptance unverified)
Contract: tr_perf_suite
Acceptance: The LLVM test-suite is whole programs (SingleSource, MultiSource, MicroBenchmarks, External; 474 rows in the guide's own run) with reference output hashes, compile-time and code-size metrics, timed by timeit and tracked over versions by LNT [@llvm-testsuite-guide]; the estate's head-to-head receipt is one workload. Done-rule: the receipt organ takes a directory of programs, each with its reference output, and writes one arm row per program per compiler with min and median, code size and compile time, appended per program as it is decided; the datavis emitter renders the trend per program across toolchain generations
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN103 — Translation validation of every optimizer rewrite: the rewritten function proven equal to the original on the IR
Prerequisites: LN8 (acceptance unverified), LN19 (acceptance unverified)
Contract: tv_validate
Acceptance: Alive proves LLVM peephole rewrites correct or finds counterexamples, the class the field's index names [@cpplinks-compilers]; the estate's e-graph oracle (LN8) and the reduction gate's scalar-versus-packed twin are validations of one pass each. Done-rule: a validator takes the IR before and after one pass over one function and either proves equality by the e-graph under the proven rule table or produces the input on which they differ, run on every rewrite the pass count names; the gate plants a rewrite that changes wrapping order and proves the counterexample is found
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN104 — Mined bug shapes: published compiler-bug corpora and the estate's own defect record become generator seeds and regression tests
Prerequisites: LN100 (acceptance unverified)
Contract: bm_mine_shapes
Acceptance: OPERATOR 2026-09-28: where no suite exists the estate invents and tests from its own intelligence, scraped bugs and other communities' feedback. The field mines miscompilation-bug corpora to steer generation (the Solidity miscompilation study, WhiteFox's white-box LLM-guided fuzzing, interleaved LLM compiler testing [@arxiv-compiler-testing-2026-08]); the estate holds its own record (nx_debt rows, the equivalence log, the gate journals) and mirrors of the field's. Done-rule: a miner reads a bug corpus (ours first, then mirrored trackers) into shape rows (the construct, the pass, the door, the trigger) that the generator of LN100 weights and the corpus of LN98 gains a test per shape; the count of shapes covered over shapes mined is printed as a partition
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN105 — Real-world corpus testing: the whole estate compiled and run by every candidate toolchain as a measured class
Prerequisites: LN100 (acceptance unverified)
Contract: tc_corpus_run
Acceptance: The field builds whole applications as test rows and runs published code through a candidate compiler before a release [@llvm-testsuite-guide]; the estate's largest real-world corpus is itself (about 25000 sources, the self-host gauntlet, every gate). Done-rule: nx_langcensus grows a build-and-run mode over the whole population per candidate toolchain, printing built, run, exit-agreed and refused as a partition that sums, appended per source; a candidate that changes any gate's verdict is refused by name
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN106 — Test reduction: a failing program shrunk to its smallest failing form by a sovereign reducer
Prerequisites: LN100 (acceptance unverified)
Contract: tr_reduce
Acceptance: C-Reduce shrinks a failing program while preserving the failure so a bug report is one screen, the class the field's index names [@cpplinks-compilers]; the estate reduces by hand. Done-rule: nx_reduce takes a program and a predicate command, removes statements and declarations while the predicate holds, and prints the reduced program with the removal count; the gate plants a known failure and proves the reduced form still fails and is smaller
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN107 — Causal guidance leads to an authorized correction and independently verified outcome
Prerequisites: LN50 (acceptance unverified), LN61 (acceptance unverified)
Contract: _ABSENT_:diag_guidance_verified_accept
Acceptance: PLANNED CONTRACT 2026-09-30. Compose existing result-action, parser/compiler, native records, PM ownership, build and recovery owners. Bind exact input/source/import/config/implementation and authority identities; explain actual versus expected behavior, cause with evidence and a permitted next action. A stale buffer, authority change, malformed optional/mandatory semantics or incomplete effect evidence cannot trigger blind replay. Exercise correct input, wrong owner, call-order defect, misleading hypothesis, stale edit, failing fix, retained capabilities and bounded rollback. The estate drives a corrected run from the returned native data, retains closure and artifact disposition, and emits matching human/machine/AI projections. No duplicate parser, diagnostic service or private JSON protocol. A source symbol or green sample alone does not satisfy this acceptance.
Authored effort: unestimated. Executor kind: Workflow. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN108 — Interactive NishiLang IDE at nishifamily.com/ide
Prerequisites: LN107 (acceptance unverified), LN11 (acceptance unverified), LN67 (acceptance unverified)
Contract: _ABSENT_:nishi_ide_served_accept
Acceptance: FUTURE ENDPOINT; DEFERRED behind bottom-up native workflow and NishiLang qualification. Reuse the language server, compiler and shared correction contract: explain, preview a source-bound change, obtain any authority still required, apply, test the original scenario and prior capabilities, show outcome and rollback. Qualify novice task completion, keyboard/accessibility, unsaved/versioned edits and actual served interaction/visual review. No-training and approved-provider controls apply to future first- or third-party LLM adapters. A build or HTTP200 is intermediate evidence. Comparison is emitted from the existing Compare/effectiveness machinery, never a manually asserted IDE superiority claim.
Authored effort: unestimated. Executor kind: Workflow. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN20a — Loop splitting for a guard bounded by a RUNTIME value: limit = smin(n, len) computed once before the loop
Prerequisites: LN20 (acceptance unverified)
Contract: bck_irce_runtime_bound
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: bck_irce_split admits only a CONSTANT guard bound wider than the array; the loop real programs write is while k < n with n a value the loop does not change, the case LLVM's pass exists for [@llvm-irce], and there every read still pays for its check (measured 2026-09-28: a fixed array under a runtime bound keeps its bounds check in the loop); done-rule: for a guard LOAD(counter) <s n with n loop-invariant, a block before the loop computes mid = smin(n, len), the main loop runs to mid check-free and the post loop to n with its checks; the induction proof accepts the smin-built bound as at most len by construction; fixtures cover n below, equal to and above len, n zero and n negative, each trapping or returning exactly as the unsplit program; the wide-guard receipt gains a runtime-bound arm beside the rivals
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN20b — Loop splitting with a pre loop: offset indexes, counters that can start below zero and descending loops
Prerequisites: LN20a (acceptance unverified)
Contract: bck_irce_pre_loop
Acceptance: WHERE THE LANGUAGE CANNOT TODAY: the split has no pre loop because every counter the induction theorem admits is proven non-negative (a non-negative constant start, non-negative constant steps), so a[k - 5], a counter that starts negative and a descending loop are refused before the splitter is asked; done-rule: the induction theorem admits an affine index and a descending counter, the split emits pre, main and post loops with the main loop check-free, and fixtures trap at exactly the first out-of-range index on BOTH sides of the array
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN109 — The defect-class ledger: every class is a row with its public record and its state in the language
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hz_census
Acceptance: knowledge/defect_classes.conf holds one row per class (its CWE ids, its matrix row, its rung and its state: unrepresentable, refused by default, refused under a mode, detected, open) and nx_hazard_census prints the partition, joins each class to the mirrored exploited-vulnerability feed (tags in total and tags added this year) and to the Top 25 rank, and writes a gauge stamp the board renders; a class with no row, a row with no rung and a feed older than its declared cadence are each a named refusal. Done-rule: the census runs on a clock row with no seat, its partition sums to the row count, a planted class with no rung turns it RED, and the lang page shows the gauge FRESH
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN110 — Resource budgets: an allocation, a queue or a retained collection carries a bound derived from its input or a declared budget
Prerequisites: LN109 (acceptance unverified)
Contract: budget_check_alloc
Acceptance: A table sized for 200 rows fed more than 200, and the heap exhaustion the embedded Lisp paper in the month's listing reports from real users, are one class: a size nobody derived. Under the budget mode a function that allocates in a loop or grows a collection names where its bound comes from (an input length, a conf row, a caller's budget), and exceeding it is a typed outcome the caller must consume, never a trap. Done-rule: the mode refuses an unbudgeted growth site in a fixture and accepts the derived twin, the over-limit fixture returns the typed refusal carrying the limit and the offered size, and the estate census prints budgeted, derived and unbudgeted sites as a summing partition (LN60 is the toolchain's half and stays its own rung)
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN111 — Termination evidence: a loop carries a variant the compiler proves or a fuel budget it spends
Prerequisites: LN17 (acceptance unverified), LN109 (acceptance unverified)
Contract: term_check_loop
Acceptance: The induction pass already classifies counted loops for bounds elision (LN17, LN20) and the same facts are a termination proof. Under the terminate mode a while loop whose guard the pass cannot bound must spend declared fuel, and running out is a typed outcome; the eBPF verifier refuses loops outright and the month's fixpoint paper shows a detector people trusted was unsound, so the evidence is checked and never assumed. Done-rule: every loop in the estate is censused proven, fueled or unproven as a summing partition, the mode refuses an unproven loop in a fixture, and a fueled loop that exhausts its fuel returns its outcome on the first excess iteration
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN112 — Every wait has a deadline: a blocking call without one does not compile under the mode
Prerequisites: LN109 (acceptance unverified)
Contract: wait_deadline_required
Acceptance: Rust lists deadlocks among the behaviours it does not consider unsafe, and the estate's own outages were waits with no bound (a daemon start that slept on a registry lock for eight minutes, a slot pool wedged behind a dead holder). The stdlib's blocking calls (futex wait, lock, lease, socket read, child wait) take a deadline value, an unbounded wait is spelled never with a reason and is counted, and a deadline is derived from the resource it waits on. Done-rule: the mode refuses a blocking call with no deadline in a fixture, the census partitions every blocking site in the estate into deadline, never-with-reason and bare, and the bare count is a ratchet that only falls
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN113 — Lock order by level: taking a lower lock while holding a higher one is a compile-time refusal
Prerequisites: LN112 (acceptance unverified)
Contract: lock_level_check
Acceptance: Deadlock by lock order is excluded for every statically named lock: each lock or lease declares a level and the compiler tracks the held set through calls; dynamic acquisition goes through try-with-deadline (LN112), so no path waits forever on an order nobody declared. Done-rule: the two-lock inversion fixture is refused naming both sites, the consistent-order twin compiles, and the estate's lock and lease sites are censused with their levels
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN114 — An error is a value that must be consumed: no trapping unwrap and no silently dropped status
Prerequisites: LN2 (acceptance unverified), LN109 (acceptance unverified)
Contract: mustuse_check_result
Acceptance: A null pointer with no error handling took a cloud control plane down and an unwrap on an error value took a proxy fleet down; both are one class, an error nobody was made to handle. A call that returns a status or an Option may not be discarded, the only way to drop one is ignore with a reason (counted), and no construct turns an error value into a trap in a non-test build. Done-rule: the mode refuses a discarded status and an unconsumed Option in fixtures, the census partitions every call site in the estate whose result is dropped, and the corpus builds unchanged with the mode off
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN115 — Horizon types: a counter or a clock declares its unit and the lifetime it must survive
Prerequisites: LN1 (acceptance unverified), LN109 (acceptance unverified)
Contract: horizon_check_counter
Acceptance: The directive names only a software counter that overflows after 248 days; that number is what a signed 32-bit count of hundredths of a second gives (2 to the 31st hundredths is 248.55 days), arithmetic nobody ran. A counter type carries its unit and maximum rate, the compiler computes the overflow horizon from the width and refuses one shorter than the declared lifetime, time values carry a unit so seconds and nanoseconds cannot be added, and the unit calculus with conversion in the month's listing is the formal bar. Done-rule: the 32-bit hundredths fixture is refused with the computed horizon in the message, the 64-bit nanosecond twin compiles with its horizon printed, a seconds-plus-nanoseconds fixture is refused, and the estate's epoch and counter sites are censused by unit and width
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN116 — A check on shared state returns a token and the act must present it
Prerequisites: LN6 (acceptance unverified), LN109 (acceptance unverified)
Contract: stale_check_refuse
Acceptance: The AWS event was a check made once at the start of a long operation and trusted at the end. A read of a shared value yields a version token, a write that depends on that read presents the token and fails when the version moved, and compare-and-swap is the only write path for a value declared shared; the estate already works this way by doctrine at its file door (an expect token on every write) and this makes it the language's rule. Done-rule: the stale-plan fixture (two writers, the slow one holding an old check) is refused at the write with both versions named, the token twin compiles and loses the race visibly, and the estate's shared-plane writers are censused by whether they carry a token
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN117 — Interpreter sinks take typed builders: bytes from outside cannot reach a command, a query or a page unencoded
Prerequisites: LN109 (acceptance unverified)
Contract: sink_typed_builder
Acceptance: OS command injection carries more exploited-in-the-wild tags than out-of-bounds write and no memory-safe language closes it. Bytes that arrive from outside are tainted by type, a sink (process arguments, a query, markup, a path) accepts only a builder that encodes each part for that sink, and concatenating a tainted value into a sink string is refused. Done-rule: the mode refuses the concatenation fixture for each of the four sinks and accepts the builder twin, the estate's sink sites are censused builder, encoded or raw as a summing partition, and the raw count is a ratchet
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN118 — Strings carry their length: the scan-to-terminator API is a named legacy class under a ratchet
Prerequisites: LN3 (acceptance unverified), LN109 (acceptance unverified)
Contract: str_slice_default
Acceptance: The estate inherited the C convention and has paid for it once already (the 2026-07-08 read past a missing terminator, now the provenance gate's fixture). New string APIs take a checked slice, a scan that walks to a terminator is censused by site, and the count only falls. Done-rule: the stdlib string surface exists over slices with the same known answers as the pointer twins, the census prints slice sites and scan-to-terminator sites as a summing partition with the baseline recorded, and a new scan-to-terminator site in a changed file is refused by the ratchet
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN119 — A retry carries a budget and jitter or it does not compile under the mode
Prerequisites: LN112 (acceptance unverified)
Contract: retry_budget_required
Acceptance: The recovery from the null-pointer outage was slowed by restarts with no randomized backoff, and the estate measured the same herd in its own job follower. The stdlib retry primitive takes an attempt budget, a wall-clock budget and a jittered ladder, and a hand-rolled loop that re-issues a network or lock call is refused under the mode. Done-rule: the bare retry-loop fixture is refused and the primitive twin compiles, the ladder's arithmetic is a known-answer tooth, and the estate's retry sites are censused primitive or hand-rolled
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN120 — Implicit conversions are refused: every narrowing, sign change and pointer-integer crossing is spelled
Prerequisites: LN109 (acceptance unverified)
Contract: coerce_refuse_implicit
Acceptance: Type confusion carries 38 exploited tags and silent coercion is the scripting languages' textbook flaw. The estate writes its casts by hand already; this rung proves the compiler refuses the alternative. Done-rule: fixtures for narrowing, sign change, pointer to integer and integer to pointer without a cast are each refused naming the two types, the positive twins compile, and the gate is rostered so a parser change that admits one turns it RED
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN121 — The research watch for this ladder runs with no seat: sources, seeds and proposals as data on a clock
Prerequisites: None declared; this does not establish execution eligibility.
Contract: fs_src_applies
Acceptance: The frontier scanner attests every bar daily, yet it asks graphics venues about language bars (204 fetches for 12 bars, measured 2026-10-03), scans only rows where a named rival leads, and nothing runs its propose verb on a clock. Sources gain a per-board scope, a board can mark rows to watch even when no rival leads, the language venues and the weakness feeds become source rows, and propose runs daily for this board and writes a gauge stamp the page renders. Done-rule: a day passes with no seat and the board shows the proposal gauge FRESH, the attest for this board fetches only its own sources, and a planted on-subject item in a fixture listing appears as a proposal while a homonym does not
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence lang writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

LB0 Self-hosted sovereign compiler · cell PRESENT · gate UNRECORDED

Contract	`func main(argc` · executor Organ · 0 u · stands on nothing
Definition of done	gen2 == gen3 fixpoint, equiv gate 10/10 -- LANDED
Matrix cell	Self-hosted sovereign compiler (native x86-64 ELF) · `runtime/nx_compile_x86.nx` · PRESENT decl Sovereign whole-stack toolchain (language compiler assembler runtime -- zero LLVM GCC libc beneath) · `runtime/nx_compile_x86.nx` · PRESENT decl
Gate	`nx_chkarith_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_optenforce_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_boundscheck_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_opt_eqsat_wire_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_x86_regalloc_use_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

LB1 Arity and param-type checks · cell PRESENT · gate NO-GATE-DECLARED

Contract	`prepass_count_params` · executor Organ · 0 u · stands on LB0
Definition of done	Compiler-enforced, bite-proven live -- LANDED 2026-08-05
Matrix cell	Call arity + param-type checking · `runtime/nx_parse.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LB2 Match exhaustiveness · cell PRESENT · gate NO-GATE-DECLARED

Contract	`parse_stmt_match` · executor Organ · 0 u · stands on LB0
Definition of done	Missing and unreachable arms refused by name -- LANDED
Matrix cell	Sum types + pattern match · `runtime/nx_parse.nx` · PRESENT decl Match exhaustiveness checking · `runtime/nx_parse.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LB3 Rich diagnostics · cell PRESENT · gate NO-GATE-DECLARED

Contract	`nx_diag_caret` · executor Organ · 0 u · stands on LB0
Definition of done	Caret, did-you-mean, multi-error recovery -- LANDED
Matrix cell	Rich diagnostics in the shipping compiler (caret, did-you-mean, multi-error) · `runtime/nx_parse.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LB4 Bounds-checked typed arrays · cell PRESENT · gate NO-GATE-DECLARED

Contract	`NX_BOUNDS_CHECK_LIVE` · executor Organ · 0 u · stands on LB0
Definition of done	Live checks, cost measured 2.23x -- LANDED
Matrix cell	Bounds-checked TYPED array access, [N]T and []T (CWE-787 and CWE-125 class) · `runtime/nx_parse.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LB5 DWARF .debug_line · cell PRESENT · gate NO-GATE-DECLARED

Contract	`lm_stmt_stamp` · executor Organ · 0 u · stands on LB0
Definition of done	Statement-granularity line table, readelf-validated -- LANDED
Matrix cell	Debug info (DWARF .debug_line, statement granularity) · `runtime/nx_linemap.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_linemap`; declare `nx_linemap TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LB6 Equality-saturation engine · cell PRESENT · gate NO-GATE-DECLARED

Contract	`nx_eqsat_union` · executor Organ · 0 u · stands on nothing
Definition of done	Seven gates, 93 teeth, all GREEN -- LANDED 2026-08-14
Matrix cell	Equality-saturation engine · `runtime/nx_eqsat.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_eqsat`; declare `nx_eqsat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN1 Checked integer arithmetic · cell LANDED · gate NO-GATE-DECLARED

Contract	`chk_add_overflow` · executor Organ · 1 u · stands on LB0
Definition of done	i64 add and mul trap or refuse on overflow under a declared mode (the shift-count rung already ships); gate proves an overflowing add traps and an in-range add is byte-identical to today
Matrix cell	Integer overflow checked (CWE-190 class) · `runtime/nx_checked_arith.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_checked_arith`; declare `nx_checked_arith TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD2 Bounds-checked typed arrays with a named refusal adopted
Work log	no log row names this rung yet

LN2 Option enforcement · cell LANDED · gate NO-GATE-DECLARED

Contract	`opt_enforce_unwrap` · executor Organ · 1 u · stands on LB1
Definition of done	A pointer or Option value must be unwrapped through a checked path before deref in checked mode; gate proves the sentinel-zero deref class (the recurring P2 meta-class) is refused at compile time on a fixture and the stdlib still builds
Matrix cell	Null and sentinel-zero deref prevented (CWE-476 class) · `runtime/nx_option_enforce.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_option_enforce`; declare `nx_option_enforce TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD10 Ownership and pointer provenance typed against the estate's OWN mined bug shapes rather than adopted wholesale from Rust proposed LD22 A pointer parameter is non-null by type and the caller proves it; only a declared nullable pointer carries a null check at its use proposed
Work log	no log row names this rung yet

LN3 Raw-pointer provenance · cell LANDED · gate NO-GATE-DECLARED

Contract	`bck_ptr_provenance` · executor Organ · 1.5 u · stands on LB4
Definition of done	A raw *u8 deref carries its allocation extent where the compiler can see one (arena allocations, sys_mmap results) and is checked like typed arrays; gate proves the 2026-07-08 READ-TO-NUL over-read fixture traps
Matrix cell	Raw-pointer access prevented (CWE-787 and CWE-125, the unchecked half) · `runtime/nx_boundscheck.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_boundscheck`; declare `nx_boundscheck TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN4 Ownership moves · cell LANDED · gate NO-GATE-DECLARED

Contract	`own_check_move` · executor Organ · 2.5 u · stands on LN3
Definition of done	Move semantics for owned buffers: use after move is a compile error; gate proves a fixture double-use is refused and the existing corpus builds unchanged under the default mode
Matrix cell	Memory safety (bounds, ownership, use-after-free) · `runtime/nx_ownership.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ownership`; declare `nx_ownership TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN5 Use-after-free prevention · cell LANDED · gate NO-GATE-DECLARED

Contract	`own_check_uaf` · executor Organ · 1.5 u · stands on LN4
Definition of done	With LN4, a freed or released owner cannot be read; gate proves a planted UAF fixture is refused and the arena no-free doctrine is now enforced not assumed
Matrix cell	Use-after-free prevented (CWE-416 class) · `runtime/nx_ownership.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ownership`; declare `nx_ownership TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN6 Data-race typing · cell LANDED · gate NO-GATE-DECLARED

Contract	`sync_send_check` · executor Organ · 2 u · stands on LN4
Definition of done	Send-Sync-class marker on values crossing the thread pool; gate proves a non-Send value handed to nx_pool_submit is refused
Matrix cell	Data-race prevention (CWE-362 class) · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD10 Ownership and pointer provenance typed against the estate's OWN mined bug shapes rather than adopted wholesale from Rust proposed
Work log	2026-09-03 measure The ranker moved LN6 to #1 once LN29 closed (target 2.0, M3). Measured the boundary first: nx_pool_submit(pool, fn, ctx: i64) has 40 call sites in 22 files; ~30 pass `p as i64` where p points at a per-task struct, the rest an integer or an address already in i64. The cast erases the type, so no marker anywhere says whether the struct may be read on the worker thread -- that is the CWE-362 hole the matrix row names. runtime/nx_sync_types.nx (the row's organ) never existed on either tree; the check lives in the parser, matrix organ repointed 2026-09-03 land sync_send_check in nx_parse.nx (the watch symbol) + the `send` marker: `struct Job send { ... }` records the author's assertion (Rust's unsafe impl Send); under --sendcheck a ctx argument to nx_pool_submit that is a cast FROM a pointer to an unmarked struct is refused in the teaching voice naming the struct and showing the marker; a plain integer, an address, or a cast from an untyped u8/i64 buffer is ABSTAINED and the imprecision is declared in the source. --sendcheck is a driver flag and joins the `checked` mode row (the control), NOT `daily`, until the corpus is marked. Default builds emit nothing under either mode. nx_sendcheck_gate (13 teeth, four runtime fixtures: unmarked refused, marked compiles, integer abstains, default-build unchanged) bite-proven RED 6/13 against the pre-LN6 compiler and GREEN 13/13 after nx_bless_compiler NEUTRAL; nx_cc_equiv_gate 10/10 plus self-host GREEN; LN29 and LN27 gates still GREEN. Sources CAS-landed on the NAS as hunks; NAS toolchain build + promote_toolchain + gate ship follow 2026-09-03 queue Corpus census under --sendcheck is running on the laptop (every func-main program); its count is the marking worklist -- each refusal names a struct that crosses the pool unmarked and needs the author's `send` decision, never a blanket mark. When that list reads zero the ratchet may move --sendcheck into `daily` 2026-09-03 measure WHOLE-CORPUS CENSUS under --sendcheck (no sampling): 7598 top-level programs, refusing=75, and the refusals collapse to SIX structs (the marking worklist is per STRUCT, one author decision each, never per program): NxFq4mCtx (nx_f32_q4k_matmul.nx, the Q4_K matmul task context -- 53 programs, the whole LLM closure) · NxGraphNode (2) · Q8Ctx · Q5Ctx · PgCtx · NxMmtCtx (1 each). The plain-integer ctx sites (nx_nofloat_llm, the pool gates) abstained as declared. NxFq4mCtx holds only a_ptr/b_ptr/c_ptr and row bounds: each task owns a disjoint [jlo,jhi) slice of C and reads A and B immutably after submit, so it is the textbook `send` case -- but the mark is the author's assertion and is left for the lane that owns the matmul, with this row as its evidence 2026-09-03 land TOOLCHAIN PROMOTED on the NAS with LN6 (fourth canaried promote of the day): /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e3d31613 919760 B (parse_field_of_struct + sync_send_check + the send marker + nxcx_log derived lengths); contentdiff live->staged lost_from_live=0. The outgoing LN29 compiler fa7d8c6e is copied to knowledge/bank (a second promote pushes it out of .prev). --sendcheck is live in the served compiler under the checked mode; daily is unchanged until the six structs are marked 2026-09-03 land nx_sendcheck_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN against the promoted LN6 toolchain (the served compiler refuses the unmarked fixture by name, accepts the marked one, abstains on the integer, and the default build is unchanged), promoted b0b93fdd, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN6's done-rule (a non-Send value handed to nx_pool_submit is refused, gate-proven) is met; the rung stays honest about scope: the check is name-keyed on the pool's one submit function, abstains on untyped buffers, and the corpus is unmarked, so the mode is `checked`, not `daily`

LN7 Backend consumes its register allocation · cell LANDED · gate NO-GATE-DECLARED

Contract	`x86_use_regalloc` · executor Organ · 2 u · stands on LB0
Definition of done	The x86 emitter keeps allocated values in their registers instead of spilling to stack homes on entry (the witness: loop counter in r12, accumulator in r13, still reloaded); done-rule: nx_probe_bchk_asm shows no home reload and the checked loop bench improves, equiv net 10/10 plus self-host GREEN -- LANDED 2026-08-23 (x86_use_regalloc, nx_x86_64_ctx.nx): the homed loop counter is compared IN PLACE (movq+cmpq scratch copy removed), main() 64->60 instrs, nx_bounds_perf checked hot loop -16.5% (8278us->6912us median); SOUND cross-block forwarding (cut-the-load-block availability, self-host-proven after a merge-unsound draft was caught and rewritten); nx_x86_regalloc_use_gate 5/5 GREEN, 3/5 RED vs banked pre-LN7; equiv 10/10+selfhost GREEN; LN1/LN2/LN3/LN8 still GREEN; promoted a21068ae both roots
Matrix cell	Competitive native speed vs C · `runtime/nx_x86_64_ctx.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_x86_64_ctx`; declare `nx_x86_64_ctx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-22 retract 2026-09-22 the lang.sota speed prose still carries the 2026-08-14 finding as the ranked number-one perf rung (the backend not consuming its register allocation); LN7 LANDED 2026-08-23 and the 2026-09-01 receipt reflects it (default 7096 us vs gcc 2061, f1 4176 = 2.03x gcc, level with Go 4154 and ahead of checked Rust 4335). The next speed rungs are the ones after it: the remaining per-iteration instruction count in f1 mode against gcc's loop, read from the emitted assembly, then vectorisation (clang 1103 us shows the ceiling on this loop)

LN8 Eqsat consumed by the backend · cell LANDED · gate NO-GATE-DECLARED

Contract	`opt_eqsat_pass` · executor Organ · 1.5 u · stands on LB6
Definition of done	The pass rewrites real IR through the e-graph under the proven rule table, queued behind the equivalence net; done-rule: x xor x folds where const_fold cannot, controls hold, byte-identical on the 13,201-source population except the rewritten sites
Matrix cell	Equality saturation CONSUMED by a backend · `runtime/nx_opt_eqsat_pass.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_opt_eqsat_pass`; declare `nx_opt_eqsat_pass TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN9 Canonical formatter · cell LANDED · gate NO-GATE-DECLARED

Contract	`srcfmt_emit` · executor Organ · 1 u · stands on LB0
Definition of done	Idempotent formatter over the tokenizer stream; gate proves fmt(fmt(x)) == fmt(x) and the formatted corpus builds to byte-identical binaries -- SHIPPED 2026-08-23: nx_srcfmt live and registered, nx_srcfmt_gate 13/13 GREEN, style measured from the corpus, the token-stream oracle guarantees non-mutation
Matrix cell	Canonical source formatter · `runtime/nx_srcfmt.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_srcfmt`; declare `nx_srcfmt TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD8 One standard library for strings, numbers, argv and files, one owner each proposed
Work log	2026-09-02 queue nx_srcfmt, nx_dbg_step_gate and nx_rvc_gate stay REGISTERED-UNAUTHORISED: no cap was ever minted for them, so no seat can run them; the unblock is one admin mint per tool (POST /api/cap/mint allow=<tool>), an admin-seat action, not more code 2026-09-02 land the mint happened from the seat: a 30-day union cap for 14 lang and OS tools via POST /api/cap/mint with the banked admin cap; nx_srcfmt_gate 13 of 13 GREEN on the NAS through nx_job_run and admitted to the gate roster; nx_srcfmt now reads LIVE in nx_catalog

LN10 Incremental build cache · cell PRESENT · gate NO-GATE-DECLARED

Contract	`inc_cache_lookup` · executor Organ · 2 u · stands on LB0
Definition of done	Per-module cache keyed by the closure sha the build door already computes (the B2 cache keys whole targets); gate proves a one-file edit rebuilds only its dependents and the output equals a full build
Matrix cell	Incremental compilation / build cache · `runtime/nx_inc_compile.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_inc_compile`; declare `nx_inc_compile TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_inc_compile_gate 40 of 40 GREEN on the NAS (one ruler with nx_closurehash, corrupt index refused whole, toolchain-byte change misses) and admitted to the roster; inc_cache_lookup was REGISTERED-DARK since it shipped

LN11 Language server · cell PRESENT · gate NO-GATE-DECLARED

Contract	`lsp_serve` · executor Organ · 3 u · stands on LB3, LN9
Definition of done	Honest greenfield (nx_lsp.nx does not exist): diagnostics, goto-def and hover over the genealogist's code graph; gate proves initialize plus a diagnostics round-trip against a recorded client transcript
Matrix cell	Language server / editor integration · `runtime/nx_lsp.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lsp`; declare `nx_lsp TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_lsp_gate ran 19 of 19 GREEN on the NAS through nx_job_run and is now ON THE GATE ROSTER (nx_gate_roster_run trial 3 of 3 green_or_skip, admit admitted_new=3); the language server had been REGISTERED-DARK since it shipped, a mention not a run

LN12 Stepping debugger · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dbg_step_over` · executor Organ · 3 u · stands on LB5
Definition of done	The doctor lane's DT1: break and step on our own binaries over the line table we emit (one contract, two pages)
Matrix cell	Stepping debugger and .debug_info (types, variables, breakpoints) · `runtime/nx_dbg_step.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_dbg_step`; declare `nx_dbg_step TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_dbg_step_gate 29 of 29 GREEN on the NAS (statement stepping over an nx_dwarf_line table, never-brick teeth: zero ptrace call sites, a pid-shaped subject refused) and admitted to the roster; nx_dbg_step reads LIVE

LN13 Capturing closures · cell LANDED · gate NO-GATE-DECLARED

Contract	`parse_closure_capture` · executor Organ · 2 u · stands on LB0
Definition of done	Closures capturing by value into a compiler-emitted environment struct; gate proves a captured counter increments across calls and a capture of a moved value is refused once LN4 lands
Matrix cell	Closures / lambdas · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 measure THE NISHILANG GAP IS NOW A PROVEN FACT WITH A RANK, NOT AN AREA. The estate ranker over this board reads rungs 51 done 42 open 9 with the partition summing, and for TARGET VERSION 2.0 at milestone M3 exactly ONE rung is on the critical path: LN13 capturing closures. Every other open rung ranks as later. The watch symbol parse_closure_capture is ABSENT-PROVEN over buildroot/runtime with matches 0, coverage_complete 1, corpus_complete 1 and no truncation marker, which is the only state in which absence may be asserted, so this is a real missing language feature and not an unwired one. Priority 800 from value 4 momentum 2 cost 10, deficit 4 against the rival columns, cluster 2, and the self-sufficiency row reads SOVEREIGN-NO-PENALTY because nx_parse carries no outside dependency. 2026-09-04 queue DELIBERATELY NOT STARTED IN THIS SESSION, AND THE REASON IS THE SUBJECT NOT THE EFFORT. The contract is closures capturing BY VALUE into a compiler-emitted environment struct, with a gate proving a captured counter increments across calls and a capture of a moved value is refused once LN4 lands. That is parser plus environment layout plus codegen, estimated at 2 units with dependency LB0, and it lands in nx_parse which is the organ that builds every other organ in the estate. The standing law for this surface is that every intermediate state must compile and that the toolchain moves only through the canaried promote lane, alone, with nothing else building. Half-landing it at the end of a long session would put the whole build farm behind a partially applied parser change, which is the one failure this estate cannot absorb. The honest next step is a session that starts with this rung and nothing else. 2026-09-04 measure THE ROLLBACK CAUTION RECORDED AGAINST THIS RUNG IS TOO STRONG AS STATED, AND THAT CHANGES WHAT THE NEXT SESSION MAY ATTEMPT. A bad nx_parse.nx SOURCE is harmless to the live compiler until promoted: sbr_is_toolchain returns 1 for the five toolchain names so no build can install a compiler even under --install, and /api/promote_toolchain validates ELF magic and size BEFORE any rename, rotates prev to prev2, canary-compiles AND runs, and auto-rolls-back. Two generations survive. The dangerous half is the SOURCE EDIT and only to the 33 importers of nx_parse.nx, which is what the declarations-first edit order exists for. Three qualifications stand: the canary is 8 fixed integer checks with NO function pointers at all so it is structurally blind to LN13 and must not be counted as coverage; nx_cc_equiv_gate must be invoked EXPLICITLY on the staged artifact and only rows 10 passed 10 selfhost 1 accepted; and ma_do_promote_toolchain tests only sz == 0 while md_tc_install returns -2 on a provenance refusal, so a promote can return HTTP 200 TOOLCHAIN-PROMOTED with bytes -2 having installed nothing -- READ bytes ON EVERY PROMOTE RECEIPT. 2026-09-27 land 2026-09-27 CAPTURING CLOSURES (LN13c) on the native and RV64 doors, sovereign end to end: nx_parse.nx parse_closure_capture (the board's contract symbol) lowers a function literal that reads enclosing names into a compiler-emitted environment from the module's own sys_mmap (slot 0 the code address, slot k+1 the captured value) BY VALUE; the literal's value is TY_CLOSURE (nx_types.nx, kind 14, pointee = return type); a call through it (postfix or direct-local) loads slot 0 and passes the environment as the hidden first argument through the existing call_indirect; inside the lifted function every captured name is an address-backed local aliasing its slot, so a counter persists across the closure's own calls and the enclosing variable never moves, and the subscript-read and address-of paths learned that an environment slot does not auto-load like an alloca (the one defect the first run found: a captured pointer read as the slot's address); an unannotated let inherits TY_CLOSURE; refused by name: struct or stack-array captures, statics, a func(...) annotation over a closure, an unprovable capture set, more than 22 arguments. Front ends shipped with the new parser: nx_compile_x86 c18411d5 (plain promote, 8 lost runs = the superseded LN13b refusal strings), nx_nxc 811bd674 and nx_compile_wat 0dd60fc3 (ship loop, behaviour IDENTICAL on the door probe), the gate nx_closure_capture_gate 67b0e86e 19/19 (by-value copy, pointer write-through, two captures beside a parameter, the non-capturing control, wasm refusal by name, two planted refusals); nx_cc_equiv_gate with the new compiler as challenger: rows 10/10, selfhost GREEN, KAT GREEN 2026-09-27 measure 2026-09-27 nx_door_census on the PROMOTED ladder with runtime/nx_closure_probe.nx: x86-64 PASS and rv64 PASS (tick=1,2,3 outer=0 mk=42 dbl=42 checksum=686096800 computed THROUGH a pointer-capturing closure), wasm32 and wasm64 REFUSED by name (WAT VALUE: function addresses require table lowering -- the LN13a table rung), five doors ABSENT; the control fixture nx_door_probe.nx still reads 4 of 4 PASS on the same promoted binaries, so the parser change is neutral for programs without closures (the door-probe WAT is byte-identical live versus staged, 403442 bytes) 2026-09-27 queue the build-lane compiler _offc/nx_cc_sovereign.elf still carries the pre-closure parser (the canaried /api/promote_toolchain lane names nx_cc_sovereign, nxasm_x86_main and nx_sov_build_run; the staged compiler is nx_compile_x86 c18411d5 and has to be offered to that lane under the toolchain name) -- until it lands, organs built by nx_sov_build_run cannot use closures while programs built through the door compilers can; the wasm door needs the call_indirect table lowering (LN13a) before closures cross it; capture by reference or move (LN4 owns the moved-value refusal), closures in func(...)-typed struct fields, closures on the wasm door and escape analysis stay open; the LN13b referee source runtime/nx_closure_gate.nx (never built) asserts that a capture is REFUSED and is superseded by nx_closure_capture_gate: retire that tooth or fold its two probes into the capture gate 2026-09-28 land 2026-09-28 the BUILD-LANE compiler carries closures: buildroot/_offc/nx_cc_sovereign.elf promoted through /api/promote_toolchain (target nx_cc_sovereign.elf, staged as nx_cc_sovereign.elf.new from the promoted door compiler c18411d5 through nx_filecopy under organ_run, provenance ledger first sighting, ELF floor, .prev banked by the lane, nx_tc_canary GREEN); the outgoing toolchain 03ff3ddb (894090 B) is banked hash-verified at knowledge/status/harness/nx_cc_sovereign.elf.bank-20260928 beside the lane's .prev; nx_cc_equiv_gate had read 10/10 rows, selfhost GREEN and KAT GREEN with this compiler as challenger before the promote; organs built by nx_sov_build_run can now use capturing closures 2026-09-28 queue organs that embed nx_parse.nx and were promoted before 2026-09-27 (the census, the formatter, the language server, the incremental cache) still carry the pre-closure parser until their next ship; the LN13b source-only referee runtime/nx_closure_gate.nx keeps a capture-is-refused tooth that LN13c supersedes; the wasm doors wait on the call_indirect table lowering (LN13a)

LN14 Qualified imports · cell LANDED · gate NO-GATE-DECLARED

Contract	`imp_qualified_name` · executor Organ · 1.5 u · stands on LB0
Definition of done	Namespace-qualified names so two organs may export the same identifier; gate proves a shadow collision from the 2026-06-23 census compiles unambiguously with qualification
Matrix cell	Namespaces / qualified imports · `runtime/nx_import.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_import`; declare `nx_import TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN15 Free multi-line expressions · cell PRESENT · gate NO-GATE-DECLARED

Contract	`tok_line_continuation` · executor Organ · 1 u · stands on LB0
Definition of done	A continuation line opening with a binary operator joins the previous statement instead of becoming a dead statement (the det2x2 bug class); gate proves the fixture that caused the runtime-wide sweep now computes and a lone operator line is a diagnosed error
Matrix cell	Free multi-line expressions · `runtime/nx_lex_kinds.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lex_kinds`; declare `nx_lex_kinds TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN16 Working f64 arithmetic · cell PRESENT · gate NO-GATE-DECLARED

Contract	`x86ctx_emit_f64` · executor Organ · 1 u · stands on LB0
Definition of done	Correct SSE2 emission for f64 add sub mul div; done-rule: nx_probe_float run-exit=0 (1.5 plus 1.5 equals 3.0), deliberately low priority under the no-float doctrine
Matrix cell	Working floating point (f64) · `runtime/nx_x86_64_ctx.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_x86_64_ctx`; declare `nx_x86_64_ctx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 measure an instance of the unchecked-lane crash class found by using the estate as a user, 2026-09-05: nx_goalmap_lib indexes sys_mmap raw arrays sized by guessed caps (GM_MAXWORDS 24, GM_MAXRUNG 512, GM_MAXMAT 512, GM_MAXDOM 16, GM_OUTCAP 16384 which was already raised once from 8192) and the promoted binary SIGSEGVs at 0x401e23 on an 8-board 16-word query while silently DROPPING words past 24 on another; the crash guard itself names the remedy (fixed arrays and slices refuse out-of-bounds with a message); debt 1788626163, engineshift ES21 owns the organ -- the fleet instrument owed here is a census of organs that size raw arrays from a const cap and index them from user input, so this class is counted rather than rediscovered one crash at a time

LR1 Errors as values, enforced with propagation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`res_propagate_op` · executor Organ · 2 u · stands on LB1
Definition of done	A dropped Result refuses (must-use) and a one-character propagation form rethrows with context; abandonment stays fail-fast (the Midori split); backfill census before enforcement; witness refuse and accept both directions
Matrix cell	Errors as values with enforced propagation (the Midori model) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD2 Bounds-checked typed arrays with a named refusal adopted
Work log	no log row names this rung yet

LR2 Structured concurrency: scoped spawn · cell PRESENT · gate NO-GATE-DECLARED

Contract	`sc_scope_spawn` · executor Organ · 2 u · stands on LB0
Definition of done	Spawn exists only inside a scope that joins its children; child error propagates to the scope; cancellation is scoped; the orphan-task shape is unrepresentable; pool witnesses stay green
Matrix cell	Structured concurrency (scoped spawn, no orphan tasks) · `runtime/nx_thread_pool.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_thread_pool`; declare `nx_thread_pool TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD3 Sum types with exhaustiveness checked by the compiler adopted
Work log	no log row names this rung yet

LR3 Package lane: content-addressed, zero install-time execution · cell PRESENT · gate NO-GATE-DECLARED

Contract	`pkg_cas_resolve` · executor Organ · 2 u · stands on nothing
Definition of done	An external module resolves by content hash with no version negotiation and no code execution at install; a planted typosquat cannot resolve; the supply-chain bet becomes a measured exceed
Matrix cell	Supply chain by construction (no install scripts, content-addressed, no registry attack surface) · `runtime/_hdl_build/nx_pkg.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_pkg`; declare `nx_pkg TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_pkg_gate 19 of 19 GREEN on the NAS (CAS resolve, typosquat refused, zero install-time execution, hash-chained journal) and admitted to the roster with nx_gdbstub_gate (SKIP: stock gdb absent on the NAS, a precondition not a defect)

LR4 Language-level capability security · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cap_root_main` · executor Organ · 3 u · stands on LN4
Definition of done	main receives root capabilities and syscall surfaces require a capability value; a dependency demanding new authority fails to compile; extends the live ocap ops surface into the type system
Matrix cell	Language-level capability security (no ambient authority) · `runtime/nx_caplang.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_caplang`; declare `nx_caplang TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LR5 Written language specification plus conformance suite · cell PRESENT · gate NO-GATE-DECLARED

Contract	`spec_conformance_run` · executor Organ · 3 u · stands on nothing
Definition of done	The spec documents syntax, types, memory and refusal semantics; the conformance runner drives the shipped compiler over the suite and a planted deviation goes RED (the Ferrocene lesson taken early)
Matrix cell	Written language specification + conformance suite · `runtime/nx_langspec.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langspec`; declare `nx_langspec TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_langspec_gate 30 of 30 GREEN on the NAS (spec_conformance_run over the shipped compiler, absent-compiler abstains, clause coverage at the ratchet) and admitted to the roster

LR6 NishiOS and Nishi Browser inheritance attestation · cell PRESENT · gate NO-GATE-DECLARED

Contract	`oa_state_name` · executor Organ · 2 u · stands on LN1, LN4
Definition of done	The attestation organ rebuilds the nishios kernel and browser closures under the enforcing compiler (ring on, crash guard on) and writes a receipt both compare pages cite; the Rule-of-2 unsafe-language leg is discharged by measurement
Matrix cell	Safety ring inherited by NishiOS + Nishi Browser (the Rule-of-2 discharge) · `runtime/nx_osattest.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_osattest`; declare `nx_osattest TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 queue nx_osattest and nx_lang_h2h are now AUTHORISED under the same cap and still dark: their gates (nx_osattest_gate, nx_lang_h2h_gate) have not been run through the job runner and admitted yet, the same two-call recipe as above

LR7 Sound bounds-check elision · cell LANDED · gate NO-GATE-DECLARED

Contract	`bck_elide_dominated` · executor Organ · 2 u · stands on LN7
Definition of done	A dominated in-range re-check is elided ONLY under the blessed dominance oracle (an unsound elision is a silent memory-safety hole, the elision proof gate is the tooth); h2h checked lane approaches the unchecked band
Matrix cell	Sound bounds-check elision (checked speed at unchecked cost) · `runtime/nx_bck_elide.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bck_elide`; declare `nx_bck_elide TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure nx_bck_elide_gate against the LIVE promoted nx_compile_x86.elf (923280 B) is 13/13 GREEN, elision proven dominance-gated, both OOB legs still trapping 71. Gate-published timings: h2h_A2_divfree_checked no_elision 41266 us vs with_elision 20711 us = 1.99x on the div-free checked accumulate loop. 2026-09-03 retract WITHDRAWN: the 08-31 claim that the live toolchain provably lacks LN7 elision and that the single outstanding action is a toolchain promote of nx_compile_x86. That promote had already landed; live is 923280 B, not the 737605 B the claim was measured against. Discriminating experiment: one gate, two compilers, run SEQUENTIALLY -- run concurrently they share the constant fixture dir /tmp/nx_bck_elide_gate and clobber each other into a false SKIP. 2026-09-03 land lang.matrix field 2 repointed runtime/nx_boundscheck.nx -> runtime/nx_bck_elide.nx (79958->79956) and the note carries the re-derivation (79956->81451). Both writes CAS-guarded, byte delta predicted and asserted. 2026-09-03 queue OPEN REGRESSION, not hidden: h2h_A_modulo_checked no_elision 102547 us vs with_elision 112529 us -- elision COSTS about 9.7 percent on the modulo shape. The gate publishes that ratio and gates nothing, so no instrument would have caught it. 2026-09-03 lesson A matrix note that hand-asserts what the SHIPPED BINARY can do has nothing re-measuring it, so it rots -- and it rots in the PESSIMISTIC direction, which nobody audits. Two rungs on this board (LR7, LN18) were understated on the same day and each cost a full re-derivation. Symbol-presence is the WRONG instrument: LR7's symbol was in source the whole time while the note said the compiler lacked it. Only a GATE VERDICT AGAINST THE LIVE ARTIFACT settles a capability claim.

LN17 Induction-guarded bounds-check elision · cell LANDED · gate NO-GATE-DECLARED

Contract	`bck_elide_induction` · executor Organ · 2 u · stands on LN7, LR7
Definition of done	The loop guard proves the single check inside its loop under a fixed rule set (non-escaping local counter, constant resets, guarded constant steps, no store on a guard-to-access path, guard bound not above the array length); nx_bck_iv_gate GREEN with both refusal directions bite-proven, nx_cc_equiv_gate 10/10 plus self-host GREEN, then promote_toolchain and the receipt re-measured by the promoted compiler
Matrix cell	Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop) · `runtime/nx_bck_elide.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bck_elide`; declare `nx_bck_elide TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD1 Integer determinism: no floats in the sovereign lane, fixed-point everywhere adopted LD18 Whole-stack co-design from the bit up: every layer is written in one language and designed together, so an optimisation is judged by the whole system's number, never the rung's alone adopted
Work log	no log row names this rung yet

LN18 Checked arithmetic at add-plus-jo cost · cell LANDED · gate NO-GATE-DECLARED

Contract	`x86ctx_ovf_fuse` · executor Organ · 3 u · stands on LN1, LN7
Definition of done	The x86 emitter renders the LN1 overflow shape as add then jo (sub then jo, imul then jo) with no spills; nx_chkarith_gate stays GREEN, the equivalence net passes, and the receipt shows the daily mode within 1.3x of the default build on the accumulate loop
Matrix cell	Checked arithmetic at add-plus-jo cost (the daily mode as fast as the default) · `runtime/nx_x86_64_ctx.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_x86_64_ctx`; declare `nx_x86_64_ctx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure nx_chkarith_jo_gate is 15/15 GREEN against the LIVE promoted compiler AND against the staged nx_compile_x86.sov.elf.new, with the anti-fallback neg-control BITE-PROVEN in both runs, so LN18 is already in the shipped compiler and the staged binary adds no capability over live. 2026-09-03 measure DONE-RULE NOT YET MET AND SAID PLAINLY: this rung's bar is the daily mode within 1.3x of the default build on the accumulate loop; the receipt in the matrix note reads daily 10567 us and checked 10688 us against 7105 us default = 1.49x. LN18 is SHIPPED but has not cleared its own bar.

LN19 Integer SIMD reduction vectorization · cell LANDED · gate NO-GATE-DECLARED

Contract	`opt_vec_reduce` · executor Organ · 8 u · stands on LN8, LN17
Definition of done	Integer reductions with a provable trip count are emitted as packed adds under the equivalence net; the receipt shows the f1 mode within 1.2x of gcc -O2 on the accumulate loop
Matrix cell	Integer SIMD reduction vectorization (packed adds for the accumulate loop) · `runtime/nx_opt.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_opt`; declare `nx_opt TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD1 Integer determinism: no floats in the sovereign lane, fixed-point everywhere adopted LD26 A loop idiom is replaced by one opcode the backend owns, and the pass is switched on only by a driver whose backend lowers it adopted
Work log	2026-09-28 land SHIPPED 2026-09-28: opt_vec_reduce (nx_opt.nx) rewrites the counted accumulate loop (LOAD local < bound header; MUL or SHL scale; GEP or ADD address; one element load; one accumulate ADD; one increment; two stores) into one OP_I64SUM (nx_types 155, ir_emit_i64sum) with n = hi - k and the counter landed on the bound; x86ctx_emit_i64sum lowers it to four two-lane SSE2 accumulators (movdqu, paddq) with an unsigned block count (shrq, andq) and a scalar tail; the switch is per door (nx_compile_x86 sets X86_SSE2_I64_LANES, --no-vecred is the A/B lever, the driver prints nx_vecred lanes=); every refusal is counted and printed per function (VECRED r_bound r_body r_escape r_elem r_shape r_preds). Door compiler PROMOTED 304d0f5d (1020048 B) with its _offc twin refreshed, nx_vecred_gate 43/43 GREEN on the NAS (promoted ed905570) and on the laptop, nx_cc_equiv_gate 10 rows plus self-host plus the constant-fold KAT GREEN on both hosts; the build lane goes through promote_toolchain in the next row 2026-09-28 measure the head-to-head accumulate loop (20480000 element reads, checksum 31447040000) on the laptop WSL host: candidate f1 981 us against 4168 us with --no-vecred and 4181 us on the pre-change toolchain; gcc -O2 2075 us and clang -O2 1098 us on the same box (lang.bench 2026-09-28); the done-rule asked for within 1.2x of gcc -O2 and the measured ratio is 0.47x of gcc, within 0.9x of clang; the receipt is re-measured by the promoted compiler in the receipt row below 2026-09-28 lesson A DISTRIBUTION TOOTH IS NOT A KNOWN ANSWER: the fixture prints beside every packed sum a scalar reference computed by a loop the pass cannot touch (it walks the index down) and the gate re-derives the closed forms from the fixture's constants, so a wrong lowering cannot read equal. A fixed array under a RUNTIME bound keeps its bounds check inside the loop (the guard proves nothing about the length), so that shape is the elision's to refuse and the reduction sees a multi-block body. A loop the optimizer proves never runs is swept before it is lowered (eight rewrites reported, seven lowerings emitted), so the gate asserts the paddq count against the emitted lowerings, never against the rewrite count. The laptop's buildroot fossil of the compiler was a Sep-4 binary: the gate takes its subject on argv and prints resolved_by= so a green is never a green about a fossil 2026-09-28 queue LN19a the RV64 and wasm lowerings of OP_I64SUM; LN19b the AVX2 four-lane door by measured CPUID as a ladder row; LN19c the surface builtin __i64_sum(p, n); LN19d the sibling reductions (product, min, max, xor, i32 elements) through the one matcher; the head-to-head receipt gains the vectorized arm on the next run 2026-09-28 land BUILD LANE PROMOTED 2026-09-28: nx_cc_sovereign.elf 304d0f5d (1020048 B, the same bytes as the door compiler) through /api/promote_toolchain, canary GREEN, previous banked by the door and separately at knowledge/status/harness/nx_cc_sovereign.elf.bank-20260928b (997200 B, the LN13c build); every organ built from here on carries the reduction vectorizer, switched on for the native door 2026-09-28 measure RECEIPT RE-MEASURED 2026-09-28 by the LN19 compiler (the laptop-lane build d0304a3e of the promoted source; the content door serves sources and knowledge, not promoted binaries, so the NAS bytes 304d0f5d are named, not run): lang.bench min of 7 on the laptop WSL host, checksum 31447040000 on all 9 arms VALID -- nishilang-f1 964 us, nishilang-drag 788 us, nishilang-default 7049 us (default mode keeps its checks in the loop and is not vectorized), checked 10512 us, daily 10509 us, against clang -O2 1092 us, gcc -O2 2055 us, go 4112 us, rustc checked 4316 us; the f1 mode is 2.13x faster than gcc and 1.13x faster than clang on this loop, drag 1.39x faster than clang; the done-rule (within 1.2x of gcc -O2) is met with a ratio of 0.47x. lang.leaderboard declared (EC80) with these rows as the h2h-accumulate board

LN20 Loop splitting for non-implied bounds (IRCE) · cell PRESENT · gate NO-GATE-DECLARED

Contract	`bck_irce_split` · executor Organ · 5 u · stands on LN17
Definition of done	A guard wider than the array yields pre, main and post loops with the main loop check-free; the F2-shaped fixture still traps at exactly the first out-of-range index
Matrix cell	Loop splitting for bounds the guard does not imply (IRCE) · `runtime/nx_bck_elide.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bck_elide`; declare `nx_bck_elide TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD28 A transformed loop marks itself in its own IR shape, never in a side table: the post loop's guard is the same test spelled mirrored (bound >s counter), which the guard finder accepts as a guard and the splitter never takes as a candidate adopted
Work log	2026-10-03 measure LN20 LOOP SPLITTING MEASURED 2026-10-03 on the laptop WSL host (Intel Core Ultra 7 255HX, 7 runs per arm, in-process microseconds, every arm printing checksum 31467520000): the wide-guard kernel runtime/nx_bounds_wide_perf.nx (a [1024]i64 summed 20000 times inside a loop whose guard runs to 2048 and whose body skips the access past the array) built by the compiler from BEFORE the rung reads f1 median 18724 us against clang -O2 6381, gcc -O2 7258, rustc -O with its bounds checks in play 7242 and go 9053, which is 2.93x clang; built by the compiler carrying bck_irce_split the same source reads f1 8825 us against clang 6416, gcc 7336, rustc 7291 and go 7865, which is 1.38x clang and 1.21x the checked rustc, a 2.12x speedup from the rung alone on the same host in the same hour; drag reads 8978; default 17660 (no elision by design); checked 24659 and daily 24548 are unchanged, because checked arithmetic puts an overflow branch between the counter's load and its store and the induction proof refuses the increment (r_iv_inc_unguarded), so those two modes keep the check on every read exactly as before. Receipts on the NAS: buildroot/knowledge/bench/lang_ln20_before.bench (sha256 0be4cf89) and lang_ln20.bench (sha256 64aa3b2c) with their confs lang_h2h_ln20_before.conf and lang_h2h_ln20.conf beside them and the rival arms in buildroot/bench/lang_h2h_wide; repro: nx_lang_h2h knowledge/bench/lang_h2h_ln20.conf from a host that carries gcc, clang, rustc and go (the NAS carries none, so the receipt names the laptop). A second differential: 400 generated programs (nx_progen_diff seeds 1 to 400), the compiler from before the rung without elision against the new compiler with --bckelide, 400 of 400 AGREE with the partition summing; the generator's loops are guarded at exactly the array length or masked, so none of the 400 reaches the splitter and that run proves only that the changed guard finder did not disturb the shapes it already handled 2026-10-03 land LN20 LOOP SPLITTING SHIPPED 2026-10-03. bck_irce_split (buildroot/runtime/nx_bck_elide.nx sha256 db562eea) is run first by opt_bounds_check_elim (nx_opt.nx sha256 476b87fb): for a loop header ending BR_COND on LOAD(counter) <s L whose body holds a constant-length check site shorter than L indexed by that counter, the whole loop (the guard and every block reachable from its true edge without passing the guard) is cloned; the original becomes the MAIN loop with its bound tightened to the smallest covered length, so the induction pass then proves and elides its check; the clone becomes the POST loop with the original bound, its guard spelled mirrored (L >s counter) so no later round splits it again and no table of split loops exists to go stale; one loop per call, the next wide loop in the optimizer's next round. Method replicated: LLVM InductiveRangeCheckElimination [llvm-irce] (limit = smin(n, len), a check-free main loop, a post loop for the rest), built here for the CONSTANT-bound case and with no pre loop, because every counter this pass admits is proven non-negative by the induction theorem (the source's own no-first-segment case); the runtime-bound case and the pre loop are rungs LN20a and LN20b, named rather than implied. Refusals are named and tallied on stderr (BCK-IRCE cand= split= with r_irce_not_wider, r_irce_shape, r_irce_opcode, r_irce_pool, r_irce_outside): a second exit or a side entry; a guard block holding anything but the counter's load and the compare (the guard runs once more at the hand-over); an opcode whose operand slots are not all value ids, an alloca among them; a body-defined value used outside the loop; a pool that cannot hold the clone. The guard finder now accepts the mirrored spelling as a guard (the post loop's increment must be guarded for the induction proof) and never the counter-on-the-left form. Gate nx_bck_iv_gate 42 of 42 GREEN on the laptop twice and on the NAS against the NAS-built compiler: F2 traps 71 with exactly one split and an unchanged trap-site count across two bodies; F6 returns 88 from inside the main loop; F8 runs every one of 1024 post-loop iterations and returns 88; F10 prints LT then traps 71, so the trap is at exactly the first out-of-range index; F7 (a break) is refused by name with nothing cloned; F9 (counter > constant) keeps its check and traps. Bite: two source mutants each turned the gate RED at 34 of 39 (the counter-on-the-left misread, under which F9 died by signal on an unchecked read; the post loop made unreachable, under which F2 exited 0 and F8 exited 255), and the restored source rebuilt byte-identical. Sibling gates against the same candidate on the NAS: nx_bck_elide_gate 13 of 13, nx_vecred_gate 43 of 43, nx_cc_equiv_gate 10 rows plus self-host plus the fold KAT. Promoted: door compiler nx_compile_x86 69467e97 (1051096 B, no capability loss), nx_bck_iv_gate 373ef6fc under allow_capability_loss with all nine lost runs named from the complete inventory (seven teeth renamed or replaced by the split teeth, two allocator messages reworded upstream in nx_syscalls), build lane nx_cc_sovereign.elf through promote_toolchain with canary GREEN; the previous build-lane compiler is banked at knowledge/status/harness/nx_cc_sovereign.elf.bank-20261003 (304d0f5d, 1020048 B) 2026-10-03 lesson A GATE HANDED A RELATIVE COMPILER PATH MEASURED A FOSSIL: cb_anchor_root moves the working directory into buildroot, so argv[1] = _build/nx_compile_x86.sov.elf silently became buildroot/_build/nx_compile_x86.sov.elf, on the laptop a month-old binary, and the first LN20 run read 18 of 20 with the pass apparently not firing while the compiler run by hand split the loop. The gate now joins a relative argv path to the caller's directory BEFORE the anchor and prints SUBJECT= with the path it really forks. The anchor had a second blind spot: the builder's --qualify runs the organ it just built from INSIDE buildroot, where the buildroot/ probe misses, so every anchoring gate read SKIP tree-not-found on the one lane that builds and runs without installing; cb_anchor_root (nx_ccbuild_lib.nx) now accepts the tree's own runtime/ as a second starting point with the first keeping precedence, proven by the same gate GREEN from both directories on both hosts. nx_vecred_gate carries serving-root-relative path constants instead of an anchor, so under --qualify 12 of its 43 teeth fail on a missing directory with every compiler-behaviour tooth passing; it was run through gate_run from the serving root, and its paths are owed the same anchor 2026-10-03 lesson A SIZE TOOTH MEASURED TWO PASSES PULLING IN OPPOSITE DIRECTIONS: F1's the-assembly-is-strictly-smaller tooth has been RED against every compiler since LN19 on any run that named a subject (31795 B plain against 31979 B under the flag), because the flag that elides the check also adds the packed-add lowering; nobody saw it because the roster forks this gate bare and a gate with no compiler named reads SKIP. The tooth now builds F1 a third way (--bckelide --no-vecred through cb_build_flags2, one build sequence with cb_build_flag delegating to it) and compares that: 30796 B against 31795 B, with the same two trap sites removed. A gate whose every scheduled run is a SKIP is a comment: this one is owed a roster row that names its subject 2026-10-03 queue WHAT LN20 DOES NOT DO, each a named row: (1) the runtime bound, while k < n with n a value the loop does not change, is the loop real programs write and the case the source's pass exists for; the split admits only a constant guard bound today: rung LN20a. (2) no pre loop: offset indexes, a counter that can start below zero and descending loops are refused by the induction theorem before the splitter is asked: rung LN20b. (3) the daily and checked modes gain nothing: checked arithmetic's overflow branch hides the counter's increment from the induction proof (r_iv_inc_unguarded, r_iv_load_not_local on the receipt kernel), so the elision and the split both stand down under the two modes that carry the most checks; teaching the proof to see through a checked add is its own rung, owed. (4) the opcode allowlist is narrower than the inliner's: a loop holding float, rotate or bit-count ops is refused r_irce_opcode; widening it needs each opcode's operand slots read off its emitter. (5) the guard-purity refusal has no fixture, because no source shape produces a guard block holding more than the counter's load and the compare today; it is a refusal that has never fired, named here so nobody counts it as proven. (6) the generator does not reach the splitter (LN100): its loops are guarded at exactly the array length or masked, so 400 of 400 agreeing seeds say nothing about a split; a wide-guard statement shape changes every seed's program, so it needs a generator version stamp on ledger rows first. (7) one split per optimizer round and at most eight rounds: a function with more than eight wide loops leaves the rest checked, counted nowhere yet. (8) the page renders one bench receipt per domain; the wide-guard receipts live under knowledge/bench and reach the page only through this log until the emitter renders several receipts. (9) nx_bck_iv_gate is forked bare by the roster and reads SKIP; it needs a row that names its subject. (10) nx_bck_elide_gate and nx_cc_equiv_gate were rebuilt on the NAS under --qualify for this verification and NOT promoted: their sources are unchanged and only the shared anchor probe in nx_ccbuild_lib differs, so the served gates stay as they were, deliberately

LN21 Compiler modes as declared data · cell LANDED · gate UNRECORDED

Contract	`nxcx_expand_mode` · executor Organ · 1 u · stands on LN1, LN7
Definition of done	Every mode is a knowledge/lang_modes.conf row expanded into declared flags; an undeclared mode refuses by name; --mode=f1 is byte-identical to its bundle (gate tooth)
Matrix cell	Compiler modes as declared data (daily, f1, drag, checked, small) · `runtime/nx_compile_x86.nx` · LANDED decl
Gate	`nx_chkarith_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_optenforce_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_boundscheck_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_opt_eqsat_wire_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_x86_regalloc_use_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

LN22 One receipt arm per mode · cell LANDED · gate NO-GATE-DECLARED

Contract	`h2_build_nx_mode` · executor Organ · 1 u · stands on LN21
Definition of done	The h2h receipt carries nishilang-<mode> arms built through --mode and the page renders them beside the rival compilers; nx_lang_h2h_gate GREEN
Matrix cell	Head-to-head receipt with one arm per compiler mode · `runtime/nx_lang_h2h.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_h2h`; declare `nx_lang_h2h TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN23 Energy per run on the receipt · cell LANDED · gate NO-GATE-DECLARED

Contract	`h2_energy_arm` · executor Organ · 2 u · stands on LN22
Definition of done	Each arm carries package energy from RAPL or a named UNMEASURABLE; the first VALID column comes from a host that exposes powercap
Matrix cell	Energy per run on the receipt (RAPL package energy per arm) · `runtime/nx_lang_h2h.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_h2h`; declare `nx_lang_h2h TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD1 Integer determinism: no floats in the sovereign lane, fixed-point everywhere adopted
Work log	2026-09-28 land 2026-09-28 ENERGY PER RUN ON THE RECEIPT: nx_lang_h2h h2_energy_arm (the board's contract symbol) composes the estate's own nx_energy_probe (source detection: powercap RAPL, a discharging battery, else UNMEASURABLE) around every arm's timed runs and hands the result to the ONE receipt writer, which emits an energy row (arm, uj_per_run, source, note) right after the arm row; nx_bench_receipt_lib grew two stride slots (BR_A_EUJ, BR_A_ESRC), the energy branch in br_parse (a row attaches to the arm it names among the arms parsed so far, a row naming no arm attaches nowhere), the writer rows and br_energy_note; old receipts read exactly as before (no energy source = 0); the probe gained ep_class_word; nx_lang_h2h_gate grew a fixture round trip (attach by name, -1 UNMEASURABLE by name, writer-to-reader identity, a row naming no arm) and live teeth behind a gv_need for an energy-aware receipt. The receipt was regenerated on the laptop (asof 1790602594, 9 arms VALID, ratio unchanged, the WSL2 host has no powercap and its battery reads Not charging) and pushed to the compare tree at 7671 bytes 2026-09-28 measure 2026-09-28 lang.bench: 9 of 9 arms carry an energy row; 9 of 9 read -1 UNMEASURABLE with the reason named (no powercap, no discharging battery; a cycle count is a speed proxy, not joules); the timing columns are unchanged in method (c-clang-O2 reference median 1130 us, nishilang-f1 4239 us, nishilang-default 7204 us on this run); no VALID energy column exists yet because no host in the estate exposes a package energy counter today (NAS: /sys/class/powercap absent; laptop WSL2: absent) 2026-09-28 queue the first VALID energy column needs a host that exposes powercap RAPL or runs the bench on battery (the laptop on battery would read PSU); the /compare renderer (bench_pass in nx_swcompare_lib) does not yet draw the energy row -- the receipt carries it, the page does not, and that column is the next data-to-page step; the cycle-counter proxy (nx_energy_model fJ per cycle) is deliberately NOT written as joules on this receipt (LN74 owns the modelled axis)

LN24 A lexer desync is attributed to the file and line that broke · cell LANDED · gate NO-GATE-DECLARED

Contract	`diag_desync_origin` · executor Organ · 1 u · stands on LB3
Definition of done	A raw control byte or an unterminated string literal in the LAST user file surfaces as a flood of unknown-name errors inside the auto-appended crash handler with THAT file's line numbers (MEASURED 2026-09-02: a raw NUL inside nx_inline_vec_measure_gate.nx read as twenty errors at nx_crash.nx lines 36 to 99, and the author looked in the wrong file; the control organ nx_probe_hexesc proved high-byte hex escapes ARE honoured, so only the attribution is wrong). The lexer refuses a control byte other than tab, LF and CR by file and line, and reports an unterminated literal at ITS opening line before any later file is expanded. Gate proves a planted NUL and a planted unterminated string are each named at their own file and line, and the neg-control proves a clean corpus builds byte-identical
Matrix cell	A lexer desync is attributed to the file and line that broke, never to the auto-appended crash handler · `runtime/nx_tokenizer.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tokenizer`; declare `nx_tokenizer TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 measure NAS built nx_compile_x86 from the landed sources (staged e6fe9cf6 913840 B, src_sha 68ebd245 = laptop, closure 5786cad0); nx_contentdiff live -> staged lost_from_live=2, both runs NAMED: the old LN25 assert-tag fragments (blocks pool exhausted in function / split it: the cap is blocks PER FUNCTION), superseded by the diag_capacity_named voice; the first /api/promote_toolchain of it was CANARY-BLOCKED (build admission refused the canary compile under the I/O storm) and auto-rolled back to ea0314ce -- an untested toolchain never goes live; re-aliased and retried once admission read GRANT 2026-09-03 land TOOLCHAIN PROMOTED on the NAS: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e6fe9cf6 913840 B (the compiler with the measured-length expander walk, the first-wins desync recorder, diag_capacity_named and every voiced site), .prev = ea0314ce, the pre-session compiler 7a07a9cc kept in knowledge/bank. LN24, LN25 and LN27 are now live in the served compiler; their watch symbols are declared in the organs the matrix names 2026-09-02 measure nx_probe_hexesc: len=002 b0=195 b1=169 -- a high-byte hex escape in a string literal yields the two bytes; the earlier desync was a raw NUL written into source by a shell heredoc that collapsed the escapes, not a lexer gap 2026-09-02 land Source-landed on the laptop in nx_tokenizer.nx (the lexer nx_compile_x86 actually imports; lex.nx is a test-only twin and was left byte-identical) plus the report in nx_compile_x86.nx: a planted NUL inside a literal now reads 'error at fx_nul.nx:3: the string literal opened at column 18 is never closed' and a planted 0x01 outside a literal reads 'error at fx_ctl.nx:3: a control byte (decimal 1) sits in the source at column 19', both file:line mapped, both fatal before the parser runs; nx_cc_equiv_gate 10/10 rows PASS plus self-host PASS verdict GREEN on the challenger. Awaiting the NAS toolchain build and promote_toolchain canary 2026-09-02 lesson Statics are module-private in NishiLang: nx_compile_x86 could not see lex_err_kind ('I do not know the name'); accessor functions are the cross-module surface. And a one-line while/if with a struct-field index inside a braces chain tripped the tokenizer's @concat macro path ('@concat produced ...'); the plain multi-line form compiles -- a lexer-level hazard worth its own rung if it recurs 2026-09-02 retract The lesson row above claimed a one-line while/if with a struct-field index tripped the tokenizer's @concat path. A minimal fixture (fx_concat.nx, one-line and multi-line forms) compiles rc=0 with the baseline compiler, so the claim is withdrawn: the message arose from an intermediate edit of nx_ir.nx, not from that construct 2026-09-02 queue The teaching-voice report lives in nx_compile_x86.nx (the driver the laptop and the PE lane build) and the tokenizer/IR changes are shared; the NAS built nx_compile_x86 once admission opened, but /api/promote_toolchain accepts only nx_cc_sovereign, nxasm_x86_main or nx_sov_build_run, and this seat could not locate the sovereign compiler's driver source (no nx_cc_sovereign.nx under buildroot/runtime or its siblings; nx_catalog answered nothing under load). OWED to the lang lane: port the same report block to the sovereign driver's lex_source call site, build it, promote_toolchain; the tokenizer statics and accessors it needs are already on the NAS 2026-09-02 retract The two LN24 messages as first landed state the fact without the estate's teaching voice (the parser's own errors print the offending line with a caret, then why-the-build-stopped and fix lines). The operator named them as output that does not help a programmer grow. Rewritten the same hour to that shape on the laptop and as a NAS hunk; the estate-wide standard is LN27 and belongs to the lang lane 2026-09-02 retract The LN24 attribution as first landed could not fire on a NUL inside a user file: nx_import expand_imports_inner walked every file as a NUL-terminated string (while src[p] != 0), so a raw NUL silently dropped the rest of that file before the lexer saw a byte of it and the open literal ran into the auto-appended nx_crash.nx -- the measured symptom, reproduced on the promoted compiler with a NUL-in-literal fixture (twenty errors at nx_crash.nx:36) 2026-09-02 land nx_import.nx now walks by measured length (let n = *len_out; while p < n) in all four loops, so the NUL reaches the lexer; diag_desync_origin(kind, line, col, byte) in nx_tokenizer.nx is the ONE first-wins recorder and the watch symbol (matrix organ repointed from the lex.nx test twin to nx_tokenizer.nx); the fixture now reads error at _fx_ln24_nul.nx:3: the string literal that opens at this column is never closed, with caret, why and fix, and the control-byte fixture reads error at _fx_ln24_ctl.nx:3 (decimal 1); nx_cc_equiv_gate 10/10 plus self-host GREEN on the challenger 2026-09-02 measure toolchain promoted on the NAS through /api/promote_toolchain (canary GREEN, .prev banked, pre-change compiler banked to knowledge/bank/nx_cc_sovereign.elf.pre-ln24ln25-7a07a9cc, verified 803170 B): live buildroot/_offc/nx_cc_sovereign.elf is ea0314ce 900368 B and carries the first LN24/LN25 hunks; the expander fix, the recorder and the voice edits are source-landed on the NAS under CAS and await the next toolchain build plus canary

LN25 Compiler capacity limits are diagnostics, not asserts · cell LANDED · gate NO-GATE-DECLARED

Contract	`diag_capacity_named` · executor Organ · 1 u · stands on LB3
Definition of done	nx_cc dies with nx_assert_lt idx=4096 cap=4096 tag=ir_block_new when one function exceeds the IR block pool (MEASURED 2026-09-02: a 253-name entity if-chain in nx_html_entities.nx), naming the pool and not the function, so the author cannot tell which function to split. Every capacity cap (blocks per function, same-callee call sites, module count) is reported as an error naming the function, the cap, the measured count and the remedy. Gate proves an over-cap function is named with its count and that a function one below the cap compiles unchanged
Matrix cell	Compiler capacity limits are diagnostics naming the function, the cap and the count · `runtime/nx_ir.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ir`; declare `nx_ir TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 measure nx_html_entities: 112 names compiled; 253 names in one function overflowed ir_block_new at 4096 blocks; split by name length (2..8) the same 253 names compile 2026-09-02 land ir_block_new now builds its assert tag on the failing path only, naming the function (blocks pool exhausted in function <name> -- split it); a 2,300-branch fixture trips it at idx=4096 and names big. Same challenger, same equivalence verdict 2026-09-02 land diag_capacity_named(pool, name, name_len, measured, cap, remedy) in nx_ir.nx is the one voice for every capacity cap (blocks, SSA values and instructions PER FUNCTION; functions and globals PER UNIT): error at function <name>: the <pool> capacity is reached -- measured N against a cap of C, then why the build stopped and fix, exit 2; a 4200-arm fixture reads error at function big: the basic-block pool (blocks PER FUNCTION) capacity is reached -- measured 4097 against a cap of 4096 2026-09-02 lesson f.name_bytes compiled on a *Function although Function declares name_start and name_len: the parser resolves a struct field by NAME across every struct, so a field of another struct reads garbage at a wrong offset with no diagnostic (the function name printed as junk until the fixture caught it). Admitted as LN29 below

LN26 Line tables ride every API build so a fault address resolves on the deployed binary · cell PRESENT · gate UNRECORDED

Contract	`hc_build_debug_armed` · executor Organ · 0.5 u · stands on nothing
Definition of done	SOURCE-LANDED 2026-09-02 (nx_hostctl cmd_buildrun), supervisor rebuild queued. MEASURED: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and the instruction to rebuild with -g; by the time anyone looked the source had moved, and nx_addr2line refused the deployed binary (no .debug_line section). The toolchain already had the whole chain (nx_cc -g emits .file/.loc, nxasm builds DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line decodes it, nx_dwline_e2e_gate runs the -g ELF) and NO build path passed the flag. Now every /api/build passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, rule 17: disarm by writing 0, no rebuild). Done when a freshly built organ answers nx_addr2line with file:line for an address inside its text on the PROMOTED binary AND the byte-identity censuses (nx_gatestale, nx_artifactdrift) treat the appended table as the like-for-like they already recognise in nx_rebuild_drain
Matrix cell	Line tables ride every API build so a fault address resolves on the deployed binary · `runtime/_hdl_build/nx_hostctl.nx` · PRESENT decl
Gate	`nx_hostctl_keepbackoff_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_hostctl_buildrun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_exactkill_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-02 land hc_build_debug_armed() in nx_hostctl cmd_buildrun appends --debug to the runner argv whenever knowledge/status/build_debug.flag reads 1 (flag written 1 this leg, data-driven disarm by writing 0); compile-proven locally with the hostctl change; NAS hostctl build queued BQ-nx_hostctl; the chain itself is proven on the NAS by nx_dwline_e2e_gate GREEN 21/21 (nx_cc -g, nxasm DWARF v5 .debug_line past the loaded image, nx_addr2line); remaining done-rule conjuncts: the first promoted --debug build answers nx_addr2line on the deployed binary and the byte-identity censuses accept the appended table

LN27 Every diagnostic teaches: one voice with location, caret, why and fix · cell LANDED · gate NO-GATE-DECLARED

Contract	`diag_voice_gate` · executor Organ · 2 u · stands on LB3
Definition of done	The parser's teaching errors already print the offending line with a caret (nx_diag_caret), then a why-the-build-stopped line and a fix line; the LN24 desync messages landed 2026-09-02 without them and the operator named the output as not helping a programmer grow to mastery. Estate-wide: every error site in the tokenizer, parser, IR, assembler and the build door carries what, where (file:line plus caret), why and how to fix, in that one voice, and the capacity asserts (LN25) join it. A gate walks every diagnostic emission site in the toolchain sources and refuses a site that prints a location without a why line and a fix line, with the positive control of the existing teaching sites passing and a planted bare location failing. Owner: the lang lane
Matrix cell	Every diagnostic teaches in one voice: location, caret, why the build stopped, fix · `runtime/nx_diag_voice_gate.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_diag_voice_gate`; declare `nx_diag_voice_gate TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land nx_diag_voice_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN in the PROVE stage (the NAS sources carry 0 bare sites too), promoted cf2f5a08, _offc twin installed, registered, and hand-added to knowledge/gateroster.conf with its evidence named -- the LN27 watch symbol is now declared in the organ the matrix row names and flips on the next regen 2026-09-03 land nxcx_log in nx_compile_x86.nx now DERIVES every message length from the NUL-terminated literal instead of trusting the hand-counted second argument: an audit of its fourteen call sites found six counts that disagreed with the literal beside them (111 vs 114, 129 vs 131, 40 vs 38, 35 vs 34, 37 vs 36 twice) -- the small ones truncated the sentence, the large ones leaked the bytes after the literal into stderr (the expand_imports line printed two stray bytes before its why line). One chokepoint fix, no call-site change; the redundant nxcx_log(name, 0) before the explicit mode-name write removed; equiv 10/10 plus self-host GREEN, voice gate GREEN; source pushed to the NAS under CAS, rides the next toolchain build 2026-09-02 land nx_diag_voice_gate.nx (symbol diag_voice_gate; matrix organ repointed to the gate): a census over 8 toolchain sources -- a site is a call to nx_diag_at or nx_diag_organ_at, an error: literal, an nxcx_log(nx_compile_x86: ...) line, an nxasm: FATAL literal or an error at function literal outside comments and definitions; a site is voiced when a why line (why the build stopped, why this matters, or an nx_diag_why_ call) AND a fix line (fix: or an nx_dym_note call) appear within 60 lines before the next site -- and it ratchets knowledge/status/diag_voice_ratchet.conf per file (tightens on a fall, never rewrites on a rise, prints BARE file:line as the worklist). Measured: 37 sites, 30 voiced, 7 bare at first sight; all 7 voiced this leg (parser too-many-problems, argument type mismatch, unreachable arm, non-exhaustive match, the build-found-N summary; the driver crash-guard-missing and validator notices; every bare driver failure and both assembler FATAL sites) -> 37/37 voiced, bare 0; gate 12/12 GREEN on the laptop, bite-proven RED 11/12 by deleting one fix line (names nx_compile_x86.nx:383 no-fix RISE) and GREEN again on restore 2026-09-02 queue NAS: build nx_compile_x86 from the landed sources, nx_stage_alias alias nx_compile_x86 elf.new nx_cc_sovereign, /api/promote_toolchain target=nx_cc_sovereign.elf (canary, auto-rollback), then nx_organ_ship nx_diag_voice_gate so the LN27 watch flips on the next regen; laptop proof GREEN already (equiv 10/10 plus self-host, voice gate 12/12, both fixtures)

LN28 SIMD lane intrinsics for the quantized decode · cell PRESENT · gate NO-GATE-DECLARED

Contract	`x86ctx_emit_q4kunpack32s` · executor Organ · 1 u · stands on LB3
Definition of done	LANDED 2026-09-02 on the laptop toolchain (blessed through nx_bless_compiler NEUTRAL: nx_cc_equiv_gate 10 of 10 plus self-host GREEN, nx_game_gate no-regression 127 to 127, nx_tc_canary 8 of 8). __q4k_unpack32s(qs, out, sc_lo or sc_hi shl 16) turns one Q4_K sub-block pair (32 packed nibble bytes) into 64 i16 lanes already multiplied by their 6-bit scale, emitted as 14 AVX2 instructions in VEX .byte form (vpmovzxbw, vpsrlw, vpand, vpmullw, vpbroadcastw, vmovups; the mask is built from vpcmpeqd and vpsrlw so no memory constant), five toolchain sites (nx_types OP_Q4KUNPACK32S 151, nx_ir, nx_parse, nx_x86_64_ctx, nx_x86_regalloc). Proof: nx_q4k_simd2_gate 9 of 9 -- lane-exact on 5000 random blocks against the scalar spread, dot-exact on 200 real-shaped rows against BOTH incumbent rulers, two neg-controls. The family this opens: a Q6_K unpack (the 28 fallback rows at 7B), a Q8_0 widen, and a lane-wise i16 multiply-add with the scale folded, each landing the same way. Done-rule met: the emitted unpack replaces about 1.4 scalar ops per weight and the fused dot runs 3.94x faster than the scalar-unpack SIMD dot on the 14-super-block row
Matrix cell	SIMD lane intrinsics for the quantized LLM decode (nibble unpack and scale, i16 multiply-add) · `runtime/nx_x86_64_ctx.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_x86_64_ctx`; declare `nx_x86_64_ctx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land the intrinsic shipped as five anchored edits to the toolchain sources on both trees (nx_types, nx_ir, nx_parse, nx_x86_64_ctx twice, nx_x86_regalloc) plus nx_q4k_dot_simd2_lib and nx_q4k_simd2_gate; the laptop compiler is blessed (sha a9480db0), the NAS compiler waits on its own promote_toolchain canary under build admission; a consumer built with the old compiler fails to COMPILE rather than silently falling back, which is why the simd2 kernel lives in its own lib 2026-09-02 measure nx_q4k_simd2_gate timing over 2000 rows of 14 super-blocks: simd (scalar unpack) 14.0 ms, simd2 (emitted unpack) 3.55 ms, 3.94x; the first gate run read 8 of 9 because the neg-control fixture drew a zero sub-block scale on 1 of 200 rows and a flipped nibble under a zero scale is arithmetically invisible -- the fixture now draws every scale non-zero and the zero-scale case stays covered lane-level 2026-09-02 lesson the compiler emits intrinsics as raw VEX byte sequences, so a new AVX2 primitive never needs an assembler mnemonic; the encoding is proven by the consumer gate against an exact reference, never by inspection alone 2026-09-03 land The Q4_K super-block dot intrinsic (OP_Q4KSBDOT const, ir_emit_q4ksbdot, x86ctx_emit_q4ksbdot and its dispatch) was a LAPTOP-ONLY fossil: the NAS toolchain sources lacked it while lang.plan called it landed. Landed on the NAS by CAS hunks (nx_types, nx_ir, nx_x86_64_ctx); the laptop and NAS toolchain sources now differ only in whitespace. Proof to run on the NAS once the canary promote lands: nx_q4k_simd2_gate (SOURCE-ONLY there today). 2026-09-03 land The Q4_K super-block dot intrinsic is PROVEN ON THE NAS at last: nx_q4k_simd2_gate promoted and run there, 9 of 9 GREEN, simd_ns 54732469 vs simd2_ns 8953465 = 6.11x over 2000 rows of 14 super-blocks. It had been a laptop-only fossil while this board said LANDED -- the NAS toolchain carried none of OP_Q4KSBDOT, ir_emit_q4ksbdot or x86ctx_emit_q4ksbdot until today. 2026-09-03 retract I PUBLISHED "LN28 PROVEN ON THE NAS 9 of 9 GREEN 6.11x". That claim measured the WRONG SUBJECT and I am withdrawing it. nx_q4k_simd2_gate mentions __q4k_sb_dot exactly once, in a COMMENT on line 192; it never calls the intrinsic. Its 9 of 9 and its 6.11x are real but they measure the __q4k_unpack32s path against the scalar ruler, not the whole-super-block dot. The discriminating experiment: the NAS parser contained ZERO occurrences of __q4k_sb_dot, so a program calling it could not have compiled at all. 2026-09-03 land The intrinsic was BUILT AND UNWIRED on BOTH trees: OP_Q4KSBDOT in nx_types, ir_emit_q4ksbdot in nx_ir and x86ctx_emit_q4ksbdot plus its dispatch in nx_x86_64_ctx all shipped, and NOTHING routed the NAME in nx_parse, so every program calling it refused with "unhandled __ intrinsic". 32 such programs, found only by the whole-population census once its marker list learned the older parse_die vocabulary. Parser mapping added (4 operands); nx_q4k_dot_simd2_lib.nx, which could never compile, now builds to 12770 bytes of assembly; 31 of the 32 compile (the 1 holdout fails on an unrelated undefined name). Toolchain ef74425bab01636f canary GREEN. 2026-09-03 lesson ★★★★★★AN INTRINSIC IS NOT SHIPPED UNTIL ITS NAME REACHES ITS EMITTER: the opcode, the IR builder and the codegen can ALL exist, be reviewed, be landed on both trees and still be unreachable from every program, because the one line that maps the spelling to the builder is missing. And the gate that was supposed to prove it passed throughout -- its subject was a sibling intrinsic. ★A GREEN GATE PROVES WHAT IT CALLS, NEVER WHAT ITS NAME SUGGESTS; READ THE CALL SITES BEFORE BELIEVING THE VERDICT.

LN29 A field name must belong to the struct it is read from · cell LANDED · gate NO-GATE-DECLARED

Contract	`parse_field_of_struct` · executor Organ · 1 u · stands on LB3
Definition of done	A field access p.f where f is not declared by the struct type of p is refused by name; today it resolves against every struct's field table and reads another struct's offset (measured 2026-09-02: f.name_bytes on a *Function compiled and printed junk). Gate proves the fixture is refused with the struct and its real fields named, and the corpus builds unchanged
Matrix cell	A field name must belong to the struct it is read from · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land parse_field_of_struct in nx_parse.nx is the ONE field resolver for x.f (the watch symbol; matrix row added, M1 ladder extended): a struct that declares fields and does not declare the named one is refused in the teaching voice naming the struct and the fields it really has; an unresolved stub (n_fields 0) keeps the silent return-base path the self-build relies on. Fixture p.c on Pair{a,b} reads error at _fx_ln29_bad.nx:6: struct Pair has no field named c, with caret, why and fix (a, b); the control compiles; nx_cc_equiv_gate 10/10 plus self-host GREEN; the voice gate counts the new site voiced (25/25 parser sites). Source CAS-landed on the NAS (four hunks). NOT promoted yet: a whole-corpus refusal census (every top-level program under the new compiler) runs first, then the canaried promote_toolchain 2026-09-03 measure The first refusal the new compiler found was real and instructive: nx_tls13_server_session_recv_ch and emit_sh read and write session.client_offered_sup_ver, which the LAPTOP copy of Tls13ServerSession never declared -- every write landed at offset 0 of the session and every read saw a non-zero pointer -- while the NAS copy had declared it in the 2026-07-31 TLS-1.2 interop fix. Converged by adopting the NAS bytes (sha a05226d2); equiv GREEN again. Lesson: a laptop tree behind the NAS reads exactly like a compiler defect; converge the file before diagnosing the compiler 2026-09-03 land nx_field_of_struct_gate (source on the NAS, organ_kind oracle): assembles fx_bad (p.c on Pair{a,b}) and fx_ok in /tmp/nx_field_of_struct_gate/, forks the PROMOTED compiler on each with stderr captured, 11 teeth. BITE-PROVEN in the honest direction: against the pre-LN29 laptop compiler the bad fixture compiled rc=0 and six teeth went RED (the silent miscompile, measured); after nx_bless_compiler NEUTRAL installed the LN29 compiler (equiv + self-host green, game gate 127==127) the gate reads 11/11 GREEN. On the NAS it must stay UNSHIPPED until the LN29 toolchain is promoted -- its PROVE stage forks buildroot/_offc/nx_cc_sovereign.elf, which is still the pre-LN29 build; shipping it earlier would be a RED gate on a correct subject 2026-09-03 measure WHOLE-CORPUS REFUSAL CENSUS (no sampling): every top-level program under runtime/ (7598 with a func main) compiled by the LN29 compiler on the laptop; refusing=1 and that one is the planted fixture _fx_ln29_bad.nx itself (removed from the tree afterwards). Zero real refusals: the corpus builds unchanged under the new rule, which is the done-rule's second conjunct. The compiler is therefore safe to promote estate-wide; the promote waits only for the queued NAS build that also carries the nxcx_log derived-length fix 2026-09-03 land TOOLCHAIN PROMOTED on the NAS with LN29: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = fa7d8c6e 915752 B (parse_field_of_struct live in the served compiler: an undeclared field on a declared struct is now a refusal estate-wide, proven safe by the 7598-program census). The pre-change compilers are durable in knowledge/bank (7a07a9cc pre-session, e6fe9cf6 voiced); the driver's derived-length nxcx_log rides the queued BQ-nx_compile_x86 build and its own canaried promote (admission refused three direct issues under the storm; the queue fires it) 2026-09-03 land nx_field_of_struct_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 11/11 GREEN against the promoted LN29 toolchain (the served compiler refuses the undeclared field by name and compiles the declared control), promoted 9e4f9a03, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN29 is DONE by its own done-rule: fixture refused with the struct and its real fields named (gate), corpus builds unchanged (7598-program census); the watch symbol parse_field_of_struct is declared in nx_parse.nx and the M1 ladder carries the rung

LN30 An else with no if is refused, never run · cell LANDED · gate NO-GATE-DECLARED

Contract	`parse_stmt_dangling_else` · executor Organ · 1 u · stands on LB3
Definition of done	An else that begins a statement is refused by name with where, why and fix (measured 2026-09-02: a stray else absorbing a missing brace compiled with exit 0 and ran its block unconditionally inside nx_autofix_intake_gate, counting every row twice); gate proves the silent-class and loud-class fixtures are refused by name while else-if chains and plain if/else still compile; the corpus builds unchanged
Matrix cell	An else with no if is refused, never run · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure nx_autofix_intake_gate printed proposed=15 kept=0 discarded=15 unexamined=15: its REFUSED-else closed one line late so `} else { SANDBOX-BUILD-FAILED }` hung as a second else, and the pre-LN30 compiler swallowed the `else {`, let that brace stand in for the missing one, and compiled the block as UNCONDITIONAL code (silent-class fixture: exit 0, 10,644 B of asm). The loud class (no missing brace) died on the module-level assert instead -- which names the wrong cause. Local corpus census over every program in the tree with the LN30 compiler: only the two planted fixtures refuse (final count lands in the promote row) 2026-09-03 land parse_stmt dispatches TK_ELSE to parse_stmt_dangling_else (refusal voice: where + why + fix, recovery parses the block so later errors still surface); nx_parse.nx a5643d0f on BOTH trees (CAS); NAS toolchain BUILT 3697bb30 (920,944 B) staged as nx_cc_sovereign.elf.new, contentdiff vs live lost_from_live=0 over 2,146 runs, live compiler banked knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613 (919,760 B verified); laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green); nx_dangling_else_gate 14/14 GREEN vs the LN30 compiler and 7/14 RED vs the banked pre-LN30 compiler (bite-proven); gate source on the NAS, organ_kind oracle row, gateroster row, lang.matrix LN30 watch row, M1 ladder carries LN30. Intake gate itself fixed (brace) + T6 partition tooth and SHIPPED 84ec4b35 (6/6) 2026-09-03 queue promote_toolchain target=nx_cc_sovereign.elf (canary) once the local census finishes clean, then nx_organ_ship nx_dangling_else_gate against the promoted compiler and roster it. LN31 candidate: the loud class and a module-level `var x: T = ...` both die on the STATEMENT-AT-MODULE-LEVEL assert whose text blames a brace -- module-level state is `static name: type`, and the compiler should say so 2026-09-03 measure Corpus census with the LN30 compiler over 13,774 programs (every func main under runtime/, laptop tree == NAS for the compiler closure): 2 refusals = the planted fixture + ONE real offender, runtime/_hdl_build/nx_archive_daemon.nx:500 -- a live daemon whose `} else { sys_close(cfd) }` hung as a second else on the /preserve route chain with main one brace short; the old parser ran sys_close after every routed request and never on a malformed one (fd leak). Fixed on both trees (44,457 B, both arms close), NAS build queued; the LN31 census runs next 2026-09-03 queue nx_archive_daemon: fixed source built on the NAS (2,056,536 B debug-armed, sha 63759023) and staged as nx_archive_daemon.elf.new; /api/promote refused it as unclassified, so it is now declared `daemon` in organ_kind.conf -- which routes it to the health-checked /api/deploy. It is not a running service today, so bringing it up is an OPERATOR decision; the staged binary carries the fd-leak fix and waits there 2026-09-03 land TOOLCHAIN PROMOTED (LN30+LN31, one canaried promote): live buildroot/_offc/nx_cc_sovereign.elf = 4d8e7a40 / 923,280 B (the debug-armed mgmt build; contentdiff vs the previous live lost exactly the 3 removed assert strings), .prev = e3d31613 / 919,760 B (the pre-LN30 live, also banked at knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613). The executed promote's edge reply was a 503 and the client retry read `no valid staged .new` -- the live hash and the rollback slot are the witnesses, not the receipt. nx_dangling_else_gate then SHIPPED against the promoted compiler: prove 20/20 GREEN (the behavioural canary), promoted e8a97dab, REGISTERED, rostered 2026-09-03 measure Debt 1788324631 (nx_browser ships UNGUARDED, sev 7) root-caused by crossing two compiler generations against two browser closures on the laptop: OLD compiler x Sep-1 closure = 0 crash-guard labels; OLD compiler x current closure = 1; NEW (LN30) compiler x Sep-1 closure = REFUSED at nx_media_deepcrawl.nx:111 with the dangling-else voice plus the desync guard `func inside a function body`. An instrumented lexer consumed every byte of the Sep-1 closure (pos==srcn==3078315, 473910 tokens, no skip-to-EOF), so the lexer is exonerated. 2026-09-03 lesson A FUNCTION THAT OPENS FIVE IFS AND CLOSES FOUR IS ACCEPTED BY A PARSER WHOSE `else` ABSORBS THE MISSING BRACE -- AND THE PREPASS, WHICH COUNTS BRACES, THEN SWALLOWS EVERY FUNCTION AFTER IT IN THE CLOSURE. The crash guard is appended LAST, so it was the first casualty: find_function NULL at main entry, DCE drops the uncalled guard, the Rule-of-2 surface ships with no fault handler. The prior row blamed scale and a slot clobber; the discriminating control was the closure, not the compiler. LN30 refuses the shape at the source; the loud main-entry warning stays as defence in depth. 2026-09-03 land nx_media_deepcrawl.nx fifth brace landed on the NAS (11279 B, was 10999, both trees dac0826c); LN30+LN31 compiler rebuilt on the NAS from 6f632e7a/089e9c8c = 4d8e7a40 (923280 B, supersedes the LN30-only 3697bb30 staging), nx_cc_equiv_gate 10/10 + selfhost GREEN, /api/promote_toolchain canary GREEN -> buildroot/_offc/nx_cc_sovereign.elf is now 4d8e7a40 (5th canaried promote; .prev = e3d31613); serving-root nx_compile_x86.elf aligned to 4d8e7a40 by /api/promote (two artifact roots, two promotes). 2026-09-03 queue nx_browser rebuilt on the NAS against the fixed closure = 51f7b258 (2,458,208 B against a served 1,439,825 B: the swallowed tail was a megabyte of code, not just the guard), promote through nx_contentdiff so the served browser carries nx_crash_guard. 2026-09-03 land nx_browser PROMOTED on the fixed closure: 51f7b258 (2,458,208 B; served was 1,439,825 B), nx_contentdiff GREEN lost_from_live=0 over 809 runs, _offc twin refreshed -- the served browser carries nx_crash_guard. Debt 1788324631 EATEN with the mechanism on its NOTE. (Appended through the new nx_fs_write append verb, EC27.)

LN31 A keyword at module level is named, not blamed on a brace · cell LANDED · gate NO-GATE-DECLARED

Contract	`parse_module_stray_keyword` · executor Organ · 0.5 u · stands on LN30
Definition of done	A statement keyword at module level (var, let, else, return, if, while) is refused with its own cause -- var: module state is `static name: type`; let: const or static; the rest: a function above closed early -- with where, why and fix, and parsing continues to the end gate; gate proves a module-level var is refused by name and its static twin compiles
Matrix cell	A keyword at module level is named, not blamed on a brace · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure Two shapes died on the STATEMENT-AT-MODULE-LEVEL assert that blamed ONE BRACE TOO MANY: the loud dangling-else fixture (exit 200) and a module-level `var g_of_gv: i64 = 0` written while migrating the office gate onto nx_gate_verdict (braces balanced; module state is `static name: type`). The message named a cause that was not there 2026-09-03 land the assert site now calls parse_module_stray_keyword (per-keyword voice, caret, why, fix, nx_diag_note_error, parsing continues); nx_parse.nx 089e9c8c on BOTH trees; laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green) for LN30+LN31 together; nx_dangling_else_gate 20/20 vs the new compiler and 10/20 RED vs the banked pre-LN30 compiler (module-var teeth included); lang.matrix LN31 watch row; ONE canaried toolchain promote carries LN30+LN31 2026-09-03 measure LN31 census with the LN30+LN31 compiler over 13,781 programs: 8 refusals = 3 planted fixtures + 5 estate sources, and ALL FIVE already died under the pre-LN30 compiler on the module-level assert (exit 200) -- runtime/_hdl_build/nx_andelinwest_build.nx, nx_dev_pipeline_test.nx (an `if` at module level, line 81), nx_team_roster.nx (a `let` at module level, line 70), nx_vcodec_neural_entropy_gate.nx, nx_xlsx.nx. Zero NEW refusals from the promote; LN31 only names their cause. nx_xlsx.nx is the office xlsx writer whose promoted binary therefore cannot be rebuilt from this source (AHEAD class) -- a worklist row, not a promote blocker 2026-09-03 queue repair the five module-level sources (each now prints where/why/fix): nx_xlsx first (the office depends on its promoted fossil), then nx_dev_pipeline_test, nx_team_roster, nx_andelinwest_build, nx_vcodec_neural_entropy_gate; re-run the census to zero real refusals 2026-09-03 retract The earlier measure row called nx_xlsx an AHEAD fossil. WRONG SUBJECT: the census ran over the LAPTOP tree and the laptop copy of _hdl_build/nx_xlsx.nx was stale and carried an extra brace; the NAS copy has no such brace and compiles under the new compiler. The two copies are forked 42 hunks both ways (NAS: XF_MAGIC hoist + shared emitter migration; laptop: a different OF-S6 CF/DV block). Before naming an estate file broken, hash the NAS twin. Adoption direction is decided by nx_contentdiff of the promoted _offc/nx_xlsx.elf against a fresh NAS build, not by copy

LN32 A bare block statement is a scope · cell LANDED · gate NO-GATE-DECLARED

Contract	`parse_stmt_block` · executor Organ · 0.5 u · stands on LN31
Definition of done	`{ ... }` at statement start parses as a scoped block: names declared inside die at its closing brace, sibling blocks may reuse a name, a leaked name is refused by name; the block fixture runs and returns its computed value; the three estate sources written with C-style inline blocks build
Matrix cell	A bare block statement is a scope · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure The LN31 census named three sources refusing at module level for the SAME reason: an inline decimal printer `{ let d: *u8 = sys_mmap(8); var m ... }` used twice per function. The parser had no bare-block production -- `{` fell into the expression fallback and its `}` closed the function early -- so nx_dev_pipeline_test, nx_team_roster and nx_andelinwest_build had never compiled. The fourth, nx_vcodec_neural_entropy_gate, was a module-level `let F_ZERO` (now const). All four compile under LN32 2026-09-03 land parse_stmt dispatches TK_LBRACE to parse_stmt_block (block_base/n_locals saved and restored, the for-body discipline); nx_parse.nx 00e0d57c on BOTH trees; fixture returns 31 at runtime; laptop bless NEUTRAL BLESSED+VERIFIED 0c550d99 (cc_equiv corpus+self-host green); nx_dangling_else_gate 24/24 vs the LN32 compiler and 12/24 RED vs the banked pre-LN30 compiler; lang.matrix LN32 watch row; M1 ladder carries LN32; LN32 census running; NAS debug-armed toolchain build in the next admission grant, then ONE canaried promote 2026-09-03 measure LN32 census with the LN30+LN31+LN32 compiler: 13,780 programs, ZERO refusals -- the four block-idiom and module-const sources now build, the laptop xlsx copy is converged to the NAS bytes, and no planted fixtures remain in the tree 2026-09-03 land TOOLCHAIN PROMOTED (LN30+LN31+LN32, second canaried promote of the session): live buildroot/_offc/nx_cc_sovereign.elf = a5702510 / 923,648 B (debug-armed mgmt build; contentdiff vs the previous live lost_from_live=0 over 2,160 runs), .prev = 4d8e7a40 / 923,280 B (also banked at knowledge/bank/nx_cc_sovereign.elf.ln30ln31-4d8e7a40, verified), canary GREEN in the receipt this time. nx_dangling_else_gate re-shipped against the promoted compiler: 24/24 GREEN, promoted a0859551, registered, rostered. LN30, LN31 and LN32 are DONE by their done-rules; nx_xlsx shipped f542ca90 through its fixed gate (office referee 2/2 GREEN); nx_archive_daemon fix staged behind an operator deploy decision

LN33 wasm threads from the sovereign compiler: shared memory, atomics, wait and notify · cell PRESENT · gate NO-GATE-DECLARED

Contract	`wat_mem_shared` · executor Organ · 2 u · stands on LN6
Definition of done	OPERATOR 2026-09-03 (max performance from current browsers, a launch that needs no install): the served world pages already carry COOP same-origin and COEP require-corp so SharedArrayBuffer is unlocked, and nothing spends it because the sovereign wasm backend emits no threads -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify, SharedArrayBuffer named only in a router comment. Done when nx_wasm and nx_wasm_scalararm emit a shared memory with a declared maximum plus the 0xFE-prefixed atomic loads, stores, rmw ops, wait and notify for i32 and i64, nx_compile_wat lowers them, NishiLang surfaces them as an atomic intrinsic family beside the LN6 send marker (a struct shared across Workers must be send-marked or the compiler refuses by name), and a gate instantiates the module in the sovereign VM twin AND in a browser over the CDP wire with two Workers incrementing one shared counter without loss, the neg-control being the non-atomic add that loses increments; the GE27 digest tooth then reads the threaded frame bit-identical to the single-thread frame. Consumers: gameengine GE30 (tiles across every core) and performance PF13 (the tick off the render thread)
Matrix cell	wasm threads from the sovereign backend -- shared memory, atomic loads stores and rmw, wait and notify (lang LN33) · `runtime/nx_wasm.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_wasm`; declare `nx_wasm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure FILED FROM THE BEACH 2026-09-03: /world/beach answers 200 with Cross-Origin-Opener-Policy same-origin, Cross-Origin-Embedder-Policy require-corp and worker-src self blob (nx_host_router emits them on every response), the served page constructs zero Workers and zero SharedArrayBuffers, and the toolchain is the first byte that is missing: nx_shelltool grep atomic.rmw over buildroot/runtime nx returned matches=0 files=23506 coverage_complete=1 corpus_complete=1. The isolation is paid; this rung is what spends it. 2026-09-03 land LANDED ON THE LAPTOP TREE AND PROVEN 2026-09-03 (both trees owed the same bytes; NAS landing follows in this leg): nx_atomic.nx (the intrinsic family as single-thread reference bodies, 32- and 64-bit load store add sub xchg cas, wait32, notify, fence); nx_wasm.nx and nx_wasm_scalararm.nx intercept the call sites (the F618 pattern) and emit `(import env memory (memory MIN MAX shared))` plus `(export memory (memory 0))` when the module declares nx_wasm_shared_req and nx_wasm_pages_max, refusing a shared request without a maximum BY NAME; nx_compile_wat gains --nothreads (the unshared twin from one source); nx_wat_compiler learns the 0xFE family (15 mnemonics, natural-alignment memarg), memory imports, limits flags 1 and 3, and refuses a shared memory without a maximum; nx_wasm_vm executes the family with single-thread semantics and supplies an imported memory. NEUTRALITY PROVEN against a control build from the pristine emitter: fx_plain and nx_wasm_pong WAT byte-identical (371951 B). nx_wasm_threads_gate (26 teeth over forked subjects plus the in-process VM twin, two named neg-controls, the --nothreads scale-down proven to run) written and built. 2026-09-03 measure THE BROWSER HALF OF THE DONE-RULE, MEASURED ON THE WIRE 2026-09-03 (nishi-ops/ac_cdp.py with the new AC_CDP_SERVE cross-origin-isolation server, headless Edge, real 20 s): crossOriginIsolated=true SharedArrayBuffer=true; two Workers over ONE shared WebAssembly.Memory each ran tick(64, 2000000) through i32.atomic.rmw.add -- final counter 4000000, exactly 2 x 2000000, zero lost; the plain-store twin tick_racy over the same shape read 2935692 (1064308 updates lost) -- the neg-control fired; wait32 in a Worker answered 1 (not-equal) and notify 0; the cmpxchg, xchg, sub and 64-bit probes read 7009, 40003002 and 10000000008, the same values the VM twin computes. The fixture bytes were 3246 B of wasm from a 1435 B NishiLang source. 2026-09-03 lesson a NishiLang static must be ZERO-initialised on both lanes (nxasm refuses G3_NONZERO_INIT_STATIC), so a driver-settable emitter flag takes the OFF polarity; and a static declared between functions is not seen by the driver that imports the lib -- declare it at the module head. The gate's browser half cannot live in a NAS gate (no browser there), so it lives on the CDP wire and the gate says so in its own note rather than pretending. 2026-09-03 land LIVE ON THE NAS 2026-09-03: sources landed under content compare-and-swap and hash-identical on both trees (nx_atomic.nx 5343c589, nx_wasm.nx ef63bff2, nx_wasm_scalararm.nx d6aee0d8, nx_compile_wat.nx 80808bb0, _hdl_build/nx_wat_compiler.nx 55d1f551, nx_wasm_vm.nx c7972b4d, nx_wasm_threads_gate.nx 6106a334); NAS builds admitted (src_path verified, src_stable=1) and PROMOTED with expect_sha256: nx_wat_compiler 74000 B fbfa0156 (nx_contentdiff GREEN lost_from_live=0, nx_behaveprobe on the real craft-world WAT IDENTICAL STRONG; the prior 58919 B stage was banked as .prev, not overwritten) and nx_compile_wat 713960 B 03ccb597 (nx_contentdiff RED on exactly three runs, all the pre-LN31 wording of the module-level parser diagnostic that a sibling lane re-voiced on 2026-09-02, so promoted with allow_capability_loss=yes and the three named here; nx_behaveprobe DIFFERS at offset 0 because the live driver printed per-function progress names to stdout ahead of the WAT while the rebuilt one routes them to stderr -- the WAT body is the same shape, and a stdout consumer now gets clean WAT). nx_wasm_threads_gate 107792 B 9d666f1f PROMOTED, REGISTERED, HAND-ADDED to knowledge/gateroster.conf and declared on knowledge/compare/lang.gates; run through nx_job_run against the SERVED binaries: 31/31 GREEN. The rung symbol on this board and on lang.matrix was corrected from the contract name wasm_shared_memory to the function that exists, wat_mem_shared, so the ranker can read the rung as landed. CORRECTION to the earlier land row: the gate has 31 teeth, not 26 -- a count recited in prose drifted within the hour, which is the reason counts belong in the verdict line and not in a note. 2026-09-03 retract the first cut lowered a NAME-INTERCEPT on a new nx_atomic.nx lib beside the incumbent __atomic_* builtins / nx_atom.nx / OP_ATOMIC_* family (x86 already lowers those to LOCK) -- a duplicate ruler; retired reversibly to knowledge/retired/buildroot_runtime_nx_atomic.nx-1788443992 and the emitters now lower the IR OPS (wat_emit_atomic_op) plus the futex __syscall(98) to memory.atomic.wait32/notify; the discriminating experiment was nx_capsearch atomic naming the incumbent 2026-09-03 measure gate 32/32 GREEN laptop against the rebuilt driver; bite: faa->sub RED 27/32, shared ignored RED 28/32, futex left no-op RED 29/32, restore hash-identical; browser (Edge headless, AC_CDP_SERVE COI): 2 Workers x 2000000 -> atomic 4000000 EXACT, racy 2277488, probe_futex 10, probe_cas 1009, probe_big 10000000003 on the 891-byte module 2026-09-03 land nx_wasm.nx v2 + nx_wasm_scalararm.nx v2 + nx_wasm_threads_gate.nx v2 CAS-landed both trees; nx_compile_wat PROMOTED abdef773 712744 B (behaveprobe IDENTICAL STRONG on nx_wasm_pong; contentdiff lost=24 occurrences all the retired nx_atomic_* names) + _offc twin refreshed; nx_wasm_threads_gate PROMOTED 06928c21 107352 B + _offc twin (lost=56 all the old 32-bit fixture text); the promoted gate ran 32/32 GREEN on the NAS against the served binaries; unshared output byte-identical to the pre-LN33 control on pong 2026-09-04 measure THE FIRST EXTERNAL LIAR-KILLER HAS RUN AGAINST OUR SOVEREIGN WASM, AND IT PASSED. Subject: the served craft_mt.wasm, fetched over https at http=200 application/wasm 263990 B. Oracle: wasm-validate 1.0.39 (WABT), running OUTSIDE the estate exactly as the standing order requires -- it grades our bytes and never enters the build path. VERDICT: `wasm-validate --enable-all` accepts the module. THAT IS A SECOND METHOD CLASS: we did not certify our own wasm, an independent implementation of the specification did, which is precisely what our single-lens internal referee structurally cannot provide. THE FEATURE ENVELOPE, MEASURED BY BISECTION RATHER THAN ASSERTED: at MVP the module is REJECTED with `error: memory may not be shared: threads not allowed` at offset 0x000d5, and with --enable-threads it validates clean. So our shipped wasm requires EXACTLY ONE post-MVP proposal -- threads/shared memory -- and nothing more exotic. ★AND THE REFUSAL IS THE POSITIVE EVIDENCE: LN33 CLAIMED the wasm lane lowers atomics over a shared memory THE MODULE DECLARES, and a module that did not declare one would have validated FINE at MVP. The MVP failure is therefore an external confirmation that the shared-memory declaration is genuinely in the emitted bytes, not merely in our emitter's intentions. ⚠METHOD CORRECTION ON MY OWN COMMAND, recorded because it would have produced a false reading: I piped wasm-validate through `head`, so every `exit=$?` in that output is HEAD's status and not the validator's -- all three printed 0 including the failing case. The ERROR TEXT discriminates; the exit line does not. Same family as the truncating-consumer law: never put a filter on a call whose status you intend to interpret.

LN34 The same atomic names lower to hardware on the native lanes: LOCK-prefixed x86-64, rv64 AMO, futex wait and notify · cell PRESENT · gate NO-GATE-DECLARED

Contract	`rv_home_t6` · executor Organ · 2 u · stands on LN33
Definition of done	OPERATOR 2026-09-03 (scale from a sensor to a supercomputer, the browser is never the ceiling): the __atomic_* builtins (nx_atom.nx) lower to OP_ATOMIC_*: LOCK on x86-64 (pre-existing), 0xFE on wasm (LN33), lr/sc + AMO on rv64 (LN34 source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim and on the NAS); done when nx_x86_64 lowers nx_atomic_add32 and family to LOCK xadd, cmpxchg, xchg and mfence, the rv64 backend to amoadd, amoswap, lr and sc and fence, nx_atomic_wait32 and notify to the futex syscall on Linux and to the NishiOS kernel wait queue, all behind the SAME call names the wasm lane intercepts (one source, three lowerings), proven by a two-worker nx_pool counter that loses ZERO increments natively where the reference bodies lose some (the same lost-update neg-control the browser proof used), plus the LN6 send-marker refusing an unmarked struct shared through them
Matrix cell	The same atomic names lower to hardware on the native lanes -- LOCK-prefixed x86-64, rv64 AMO, futex wait and notify (lang LN34) · `runtime/nx_riscv.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_riscv`; declare `nx_riscv TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land nx_riscv.nx: rv_home_t6 + OP_ATOMIC_LOAD/STORE/FAA/CAS/FENCE lowered to fence rw,rw+ld+fence r,rw / fence rw,w+sd / amoadd.d.aqrl / lr.d.aqrl-sc.d.aqrl loop (labels .L<fn>_cas<id>, a7 as the 4th scratch) / fence rw,rw; nx_rv64_asm.nx: +12 RV64A mnemonics (.d/.w, bare and .aqrl), fence with iorw sets, slt family, bnez/beqz, .L labels admitted (ra_is_directive); _hdl_build/nx_rv64_atomic_gate 26/26 GREEN: assembler vs field-layout oracle, rv64im_min_sim executes the atomics, backend lowers every op, END-TO-END the backend's emitted tick(cell,1000) runs on the sim in 22053 steps and returns 1000 with cell=1000, probe_cas returns 1009; bite: faa->amoswap RED 24/26, cas bne->beq RED 25/26, store fence dropped RED 25/26, lr without aqrl RED 25/26, .L labels dropped RED 23/26, restores hash-identical; all three sources CAS-landed on the NAS (24208 / 110424 / 19764 B) 2026-09-03 queue nx_riscv.nx is in the compiler closure: the NAS toolchain must be rebuilt + canaried (/api/promote_toolchain after nx_cc_equiv_gate 10/10 + self-host) before the rv64 lane serves it; NAS build of nx_rv64_atomic_gate launched (job 1788445673), then register + roster + lang.gates row 2026-09-03 lesson A MUTANT THAT DID NOT APPLY READS AS A SURVIVOR: two backend mutants first survived 26/26 because the sed never matched a backslash-n inside a string literal -- assert mutated_lines>0 before every mutant build or the harness proves nothing (the NOT-REACHED class of nx_gate_bite, reached by hand) 2026-09-03 measure rv64 had NO lowering for OP_ATOMIC_* (nx_riscv.nx printed # unhandled op; only OP_FENCE existed) and the sovereign text assembler nx_rv64_asm had no amo/lr/sc/fence, no slt/sltu/slti/sltiu/sra/srai/xori, no bnez/beqz, and DROPPED every .L label as a directive -- the backend's own loop could not be assembled; x86 lowering pre-existed (x86ctx_emit_atomic), so LN34's real gap was rv64 + the assembler 2026-09-03 retract the queue row above named a TOOLCHAIN CANARY as the next door; measured by nx_catalog: nx_cc (the served x86 compiler) does not import nx_riscv.nx at all, and the rv64 driver nx_nxc is BUILT-UNPROMOTED on the NAS (605385 B fossil, never served), as is nx_main -- so the lowering reaches production through the organs that IMPORT nx_riscv.nx on their next build (laptop census of buildroot/runtime + _hdl_build: nx_main, nx_nxc and six nx_smoke_nxc_pipeline* sources), not through /api/promote_toolchain; nx_rv64_atomic_gate PROMOTED e7866f8e 871136 B, REGISTERED, _offc twin refreshed, RAN 26/26 GREEN on the NAS, declared on lang.gates with that receipt; remaining door = promote nx_nxc so an rv64 build is a served organ

LN35 memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling · cell LANDED · gate NO-GATE-DECLARED

Contract	`wasm_memory64` · executor Organ · 2 u · stands on LN33
Definition of done	the emitter wraps every address to i32 and the WAT compiler encodes 32-bit limits, so a world larger than 65536 pages cannot exist on the browser door; done when a module declaring `static nx_wasm_memory64_req: i64 = 1` emits `(memory i64 MIN MAX)` (the memory64 limits flag), every load, store and atomic drops the i32 wrap, the mmap helper grows in i64, the WAT compiler and the VM twin carry the flag, a module past the wasm32 ceiling instantiates in a memory64 browser over the CDP wire, and a module WITHOUT the declaration still emits wasm32 byte-identical to today
Matrix cell	memory64 -- the wasm32 4 GiB wall as a declared choice, never a ceiling (lang LN35) · `runtime/nx_wasm.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_wasm`; declare `nx_wasm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 measure MEASURED 2026-09-04, corpus_complete=1: the wasm32 address wrap is 27 SITES across FOUR files -- nx_wasm.nx 14, nx_wasm_scalararm.nx 10, wasm.nx 3, plus the opcode-table entry in _hdl_build/nx_wat_compiler.nx (i32.wrap_i64 -> 17). The memory declaration is already a DATA mechanism to copy rather than invent: wat_mem_shared reads `static nx_wasm_shared_req` via wat_global_i64 and wat_mem_pages_max refuses a missing maximum BY NAME, with WAT_PAGES_SPEC_MAX=65536 enforced by wat_die saying the module could never instantiate -- a message that becomes FALSE under memory64 and must itself become flag-aware. 2026-09-04 queue EXECUTABLE WORK ORDER, so the next seat does not re-derive it. DO NOT hand-edit 27 wrap sites: extract ONE helper wat_addr_narrow(o, ind) that emits i32.wrap_i64 under wasm32 and NOTHING under memory64, then migrate all 27 call sites to it. Rationale is the failure mode, not tidiness -- a single MISSED wrap under memory64 is a SILENTLY TRUNCATED POINTER, and 27 hand edits guarantee one is missed. The wasm32 path then proves its own neutrality: with no declaration the emitter must produce BYTE-IDENTICAL WAT to today, which is LN35's own done-rule. Order so every intermediate state is safe: (1) add wat_mem64 reading `static nx_wasm_memory64_req: i64 = 1`, mirroring wat_mem_shared; (2) add wat_addr_narrow and migrate all 27 sites while the flag is still always-off, proving byte-identical output; (3) ONLY THEN emit `(memory i64 MIN MAX)` in both forms and widen the ceiling to the wasm64 limit; (4) teach nx_wat_compiler the memory64 limits flag and the VM twin. UNTIL STEP 3 THE FLAG MUST REFUSE BY NAME rather than emit a 64-bit memory over wrapped addresses -- a module that declares memory64 and silently truncates is worse than one that cannot declare it at all. 2026-09-04 land STEP 2 OF THE WORK ORDER LANDED AND BUILD-PROVEN, both WAT emitters. 22 of the 27 address-narrow sites collapsed into ONE wat_addr_narrow(o, ind) helper: nx_wasm.nx 12 of 13 (45966 to 46804 B) and nx_wasm_scalararm.nx 10 of 10 (36933 to 37668 B), the twin done in the SAME pass because a fix that lands in one organ and not its sibling is half a fix. Every edit predicted its byte delta and every prediction was EXACT: form A 19 B per site, form B 29 B per site, and the partitions reconcile (4+7+1 and 2+7+1). Builds GREEN: nx_compile_wat 646076 B sha 81493399, nx_compile_wat_scalararm 640822 B sha be37a2fe. The flag static wat_mem64_on is declared and permanently 0, so emitted WAT is unchanged BY CONSTRUCTION -- the helper body is byte-for-byte what wat_at_line does. HONEST GAP: the byte-identical-WAT proof is NOT yet run, because nx_behaveprobe needs a staged artifact and nx_stage_alias only aliases an existing .elf.new that /api/build normally writes; the sovereign lane writes buildroot/_build instead, and forcing it would mean a TOOLCHAIN promote, which is a canaried lane. So this is COMPILES-GREEN, not PROVEN-NEUTRAL. 2026-09-04 lesson THE 27th SITE IS NOT AN ADDRESS NARROW AND MUST NOT BE FOLDED IN. The i32.wrap_i64 inside the emitted $nx_wasm_mmap helper converts the PAGE COUNT for memory.grow, not an address; under memory64 memory.grow takes i64, so it changes for a DIFFERENT reason. Folding it into wat_addr_narrow would be one name serving two unrelated decisions, which can then never be tuned for either -- and LN35's own done-rule already lists the mmap helper separately. Three more sites live in wasm.nx and are NOT migrated pending a liveness check, and one grep hit is the opcode-table entry in nx_wat_compiler.nx, which is a decoder row rather than a call site. PARTITION OF THE 27: 22 migrated, 1 deliberately excluded, 3 unmigrated-pending, 1 not-a-call-site. 2026-09-27 land 2026-09-27 the wasm64 door is built and shipped, sovereign end to end (every receipt reads nx_cc->nxasm_x86, no gcc): nx_wasm.nx wasm_memory64 decides the index type ONCE from the driver flag --memory64 or a module static nx_wasm_memory64_req = 1 (the board's contract symbol, so the LN35 cell stops reading dark), wat_addr_const emits address constants in the index type, the page ceiling follows the index type, the mmap helper grows in i64 and fails with -1; nx_wasm_data.nx emits i64.const data offsets under wd_idx64; nx_compile_wat parses --memory64; nx_wat_compiler encodes limits flag 0x04 (4/5/7) through wc_mem_flags and wc_mem_atom and accepts i64.const segment offsets; nx_wasm_vm carries mem_idx64, a u64 LEB reader, the 2^48-page ceiling, an i64 grow delta with a -1 failure and the i64.const segment check; nx_wasm_run_gate grew tool ladders and eleven memory64 teeth (28/28). SHIPPED: nx_wasm_run 5a3ca7b5, nx_wat_compiler 092e791b (3 lost runs = its reworded data refusals, probe IDENTICAL STRONG on the real WAT), nx_compile_wat 0792cdc4 (4 lost runs = the four indentation-prefixed i32.const literals now emitted through wat_addr_const; behaviour reviewed: the WAT differs from the live binary by ONE extra SSA local in the first function, a parser-closure change -- nx_parse.nx mtime 1790522705 is newer than the live build 1790480590 -- not a lowering change), nx_wasm_vm_verify 1ce8f560, nx_wasm_vm_memgrow_gate 539e36bc (21/21 on the new VM), nx_wasm_run_gate 0d412154; lang_doors.conf row wasm64 is DECLARED with its three stages; nx_wat_refuse_gate 14/14 on the new emitter; nx_wasm_threads_gate unchanged at its pre-existing 33/37 (the same four shared-memory limits teeth, GE30) 2026-09-27 measure 2026-09-27 nx_door_census job 1790541519 (default fixture buildroot/runtime/nx_door_probe.nx, promoted binaries): x86-64 PASS 3/3, wasm32 PASS 3/3, rv64 PASS 2/2, wasm64 PASS 3/3 (checksum=686096800 through env.nx_write on the VM twin under the i64 index type), mcu gpu quantum photonic cluster ABSENT; doors=9 declared=4 pass=4 fail=0 runs_unmeasured=0 refused=0; the sota cell "Native backends in one shipped toolchain" moves from 3 to 4 doors 2026-09-27 queue the LN35 done-rule is met on the sovereign VM twin and NOT yet on a browser: (1) a module past 65536 pages instantiating in a memory64 browser over the CDP wire (the oracle stays outside the build path; the page loader must bind env.nx_write and env.nx_getrandom first), (2) a declared MAX on unshared memories (the emitter emits MIN only under both index types today), (3) memory64 with a shared memory (refused by name: the shared data init and the per-thread stack are 32-bit), (4) memory64 tables (tables stay 32-bit in the VM); the five ABSENT doors keep their rungs (LN91 mcu, LN75 gpu, LN92 quantum, LN93 photonic, LN94 cluster)

LN37 An f64 ordered compare of a single-use loaded operand is correct · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`x86ctx_cmp_f64_operands` · executor Organ · 1 u · stands on nothing
Definition of done	LANDED 2026-09-03. The f64 compare emitter cleared the G1 op0-in-rax fact BEFORE the operand loads, so a G4-elided operand was re-read from a slot nothing wrote and tripped .G4_elided_slot_load_bug on any f64 ordered compare of a loaded value; the clear now happens after the ordering-key transform. Toolchain 6cf44630 canary GREEN.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `x86ctx_cmp_f64_operands`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land f64-compare op0-in-rax fix landed on the NAS toolchain source by CAS and promoted via canary (6cf44630, GREEN, prev a5702510 banked). Whole-corpus census 3267 programs zero G4 traps. Found by the CM4 quadrature gate.

LN38 A NaN operand compares unordered: every ordered predicate false, only != true · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`x86ctx_emit_f64_nan_guard` · executor Organ · 1 u · stands on LN37
Definition of done	LANDED 2026-09-03. The ordering-key transform made a NaN a total order so n != n read false and a sign-set NaN sorted below every number; an integer-only guard (exponent 2047 and mantissa nonzero, no ucomisd needed) now forces the IEEE-correct flags. Proven by nx_f64_gate 27 of 27 GREEN and bite RED against the pre-fix compiler.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `x86ctx_emit_f64_nan_guard`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land NaN unordered-compare guard landed in the same toolchain promote; nx_f64_gate grew two LN38 teeth, 27 of 27 GREEN with the fix and 26 of 27 RED against the banked pre-fix compiler (fixture exit 103). 2026-09-03 lesson The ordering-key transform is a TOTAL order on the bit pattern, and a total order has no unordered element; IEEE-754 requires NaN to be unordered, so any comparator built on a total-order key is wrong on NaN by construction. The assembler had no ucomisd or jp, so the guard is integer arithmetic on the exponent and mantissa fields.

LN36 Decimal exponent float literals · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`lex_number_exponent` · executor Organ · 1 u · stands on nothing
Definition of done	OPEN. lex_number in nx_tokenizer accepts a fraction and f32 or f64 suffixes but has no exponent form, so 1e-9 does not lex; today such constants are spelled in full decimals. Cheapest of the three literal gaps.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `lex_number_exponent`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 queue Three literal gaps found while writing the CM4 gate, each with a workaround so nothing is blocked: exponent form (LN36), f64 const-expr (LN39), large-fraction overflow (LN40). Recipes are in each rung note. 2026-09-03 land Decimal exponent literals (1e9, 2.5E-3, 6.02e+23): the lexer is now one digit machine (value = m x 10^e10 with m the first 18 significant digits and a sticky bit for dropped digits) and fp64_from_dec packs it -- exact rational core when m below 2^53 and the power of ten fits an i64, a 128-bit wide path (umulhi chunks of 5^25) otherwise, correctly rounded down to 1e-43 and within 1 ulp beyond. Fixture nx_fx_f64_lit: 13 checks, every literal bit-equal to ONE IEEE operation on exact operands. Laptop toolchain 2aaa21ad blessed (equiv + self-host green); NAS sources landed by CAS hunks (tokenizer, quant, parse, compile_x86); NAS build b940c1fe staged; canary promote retrying under an admission storm. 2026-09-03 land THE MEMORY DECLARATION IS NOW A BUILD-LANE DOOR, WHICH IS THE CORRECT DESIGN AND NOT A WORKAROUND: the standing order is that a target's limit is a declared door on a ladder, never a constant in the source, and ONE source must build at a sensor's memory and at a supercomputer's -- a static bakes one answer in. nx_compile_wat gained --shared <pages_req> <pages_max> (zero-init statics wat_shared_req/wat_pages_req_flag/wat_pages_max_flag, the only initializer the native lane accepts; zero means not-given so the LN33 module-global path is untouched). PROVEN: pong WITHOUT the flag is BYTE-IDENTICAL to the banked control, --shared 3 8 on a module with NO statics emits (import env memory (memory 3 8 shared)) plus the re-export, --shared 3 8 --nothreads emits the UNSHARED twin AT THE SAME DECLARED SIZE, and --shared 0 8 / --shared 9 4 are refused by name. nx_wasm_threads_gate 32/32 -> 37/37 GREEN on the NAS against the promoted binaries; nx_compile_wat promoted 6c6f5f4d 643364 B, gate promoted 1895335d 98850 B, both _offc twins refreshed 2026-09-03 land Toolchain b940c1fe canary GREEN on the NAS (LN28 + LN36 + LN39 + LN40 + the u64 literal bound), prev 6cf44630 banked. nx_f64_gate rebuilt, promoted and run THERE: 33 of 33 GREEN, covering both refusal neg-controls (each asserting the diagnostic NAMED the defect, read from the compiler cclog) and both positive controls (largest i64 literal, and a u64-range decimal keeping its bit pattern). 2026-09-03 measure nx_langcensus over the whole tree with the promoted compiler: 13718 top-level programs, ok 10195 err 3523 hang 0 harness 0, partition RECONCILES, 200 distinct refusal reasons. That err figure was then REFUTED by its own author -- see the lesson row. 2026-09-03 lesson A NEW INSTRUMENT IS GUILTY UNTIL PROVEN, AND ITS FIRST RUN INDICTED ITSELF. nx_langcensus read 3523 refusals where an independent shell census read 773, and 2866 of them carried an EMPTY reason -- almost exactly the gap. Cause: tr_run_capture_to merges stdout and stderr, and the compiler writes the whole assembly to stdout (its own is 4178018 bytes), so a 256 KiB capture overflowed and every large program came back non-zero with no diagnostic. Fixed by sizing the capture from the largest measured assembly (16 MiB, mmapped once) AND by making a filled capture ABSTAIN as HARNESS rather than convict as a refusal, plus naming the no-marker class instead of letting it group as one blank cause. Re-run: error rate 25.7 percent to 6.4 percent, matching the independent instrument. TWO INSTRUMENTS THAT DISAGREE LOCATE A DEFECT NEITHER COULD FIND ALONE, AND THE CONFIDENT ONE WAS THE BROKEN ONE. 2026-09-03 queue The census baseline lives at knowledge/status/langcensus.baseline with the compiler banked beside it at knowledge/status/ccbank/cc_live.elf. NEVER keep either in /tmp: the tmpstorereap beat destroyed the rows file at 13718 of 13790 rows and then the staged compiler, three times in one session. Next compiler change: run nx_langcensus <new-cc> <out> 60000 knowledge/status/langcensus.baseline and read the DELTA lines -- each names a program whose class moved. 2026-09-03 measure nx_langcensus found the single largest refusal class in the estate: 314 of 13721 top-level programs refused with "a control byte (decimal 14) sits in the source here" -- larger than the next nineteen classes combined, and invisible to every gate because a source that cannot compile runs no test. Each carried ONE contiguous run of exactly 119 bytes of 0x0E sitting inside an integer-print helper, between the digit loop and its return. 2026-09-03 land nx_ctlbyte_repair BUILT, PROMOTED and REGISTERED: a sovereign NishiLang organ that walks NAMED roots, locates the corrupt run, and classifies it by the contract the surrounding code pins -- INSERT-TAIL when the reversal and write were destroyed, DROP-RUN when only trailing cleanup was, UNKNOWN-SHAPE when neither, which it refuses to touch. Dry by default; --apply re-reads every file afterwards to prove the byte is gone. Repaired 314 of 314 on the laptop tree, all verified, tree now CLEAN. 2026-09-03 measure THE REPAIR IS PROVEN BY THE INSTRUMENT THAT FOUND IT: a second census against the pre-repair baseline reads programs 13727 ok 13300 err 427 hang 0 harness 0 RECONCILES, delta new_err=0 new_hang=0 FIXED=320. Refusals fell 747 to 427 with nothing broken, and 13 of the recovered sources are on the gate roster -- their binaries had been running while their sources could no longer rebuild them. 2026-09-03 retract I published that the corruption was present on BOTH trees. WRONG, and the discriminating measurement is the organ itself: reading actual bytes across 19272 NAS sources it reports affected=0 CLEAN. My both-trees claim came from grepping an od dump where the OFFSET COLUMN matched the octal I was searching for. A grep over a formatted hex dump is not a byte test. 2026-09-03 lesson The laptop copies were AHEAD as well as corrupt: the NAS original prints "RED" where the laptop prints "verdict=RED", the token every last-line verdict reader anchors on. Adopting the intact NAS copies wholesale would have compiled the tree and DELETED that work. The reconstruction was behaviourally equivalent instead (one buffered write rather than k single-byte writes) and preserved the newer content -- proven by building and running the repaired gates, 11 of 11 and 17 of 17 PASS with the helper printing those counts. ★A CORRUPT FILE IS NOT AUTOMATICALLY AN OLD FILE, AND THE INTACT TWIN IS NOT AUTOMATICALLY THE ONE TO KEEP. 2026-09-03 lesson The organ FIRST shipped with its roots hard-coded as runtime/, and on the NAS (CWD = the serving root, 17 files) it reported files=17 verdict=CLEAN over a tree whose sources live in buildroot/runtime/. ★A SCANNER POINTED AT THE WRONG ROOT PRODUCES A CONFIDENT, COMPLETE-LOOKING FALSE NEGATIVE. Roots are now arguments, the organ PRINTS the ones it walked, and a zero-file walk exits UNPROVEN instead of CLEAN (bite-proven).

LN39 Float and f64 constant-expressions · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`const_eval_f64` · executor Organ · 1 u · stands on nothing
Definition of done	OPEN. const_eval_primary in nx_parse accepts only integer literals, so const X: f64 = 0.5 is refused; today f64 module constants are written as zero-argument functions.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `const_eval_f64`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land const NAME: f64 = EXPR folds at compile time with the software IEEE-754 routines the f64 gate proves bit-for-bit against the hardware ops (+ - * / unary minus parens; int literals and int consts convert exactly; f64 consts chain). Fixture nx_fx_f64_const: 7 checks equal to run-time hardware bits. kind 2 in the module-const table; use sites materialise a TY_F64 constant.

LN40 A large-fraction literal is refused, never looped on · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`fp64_from_parts_bounded` · executor Organ · 1 u · stands on nothing
Definition of done	OPEN. A 20-digit fraction overflows the exact-rational packer in nx_quant (10 to the 20 exceeds i64) and the compiler loops instead of refusing; today tiny values like 1e-20 are built by multiplying representable literals.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `fp64_from_parts_bounded`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land The compiler no longer hangs: a 20-digit fraction (sticky) and a 22-digit whole part (wide path) both pack; an integer literal that needs a 65th bit is REFUSED by name with the teaching voice (kind 3). Census over 13790 programs under the new compiler: 773 refusals vs 777 before, and the ONLY new ones are 4 -- the planted fixture and THREE real estate gates whose limb constants were always wrong (see queue row). nx_f64_gate LAYER 6 is 33/33 GREEN; against the pre-fix toolchain the literal fixture TIMES OUT (the hang, witnessed under timeout 20), the const fixture is refused and the overflow literal wrongly compiles. 2026-09-03 lesson The first cut refused every decimal above i64 max and the census jumped by 286 refusals: the estate writes u64 patterns in decimal (FNV offset bases, all-ones masks, hash multipliers), so the bound is 2^64-1 and a decimal in [2^63, 2^64) is the unsigned pattern. Every fixture was green under the strict bound; only the whole-corpus census could see the class. A census whose compiler binary is rebuilt mid-run is contaminated -- run it on a frozen copy. 2026-09-03 queue Three authored bigfloat gates carry a 20-digit limb constant above 2^64 and now refuse to compile: _bf_sinhcosh_gate_authored.nx:60 st[0] = 31622776601683793320, _bf_tan_gate_authored.nx:61 st[0] = 26457513110645905905, _f64_sinhcosh_gate_authored.nx:69 st[0] = 27182818284590452353. They compiled before only because the literal WRAPPED, so every result they graded used a wrong constant. The bigfloat lane owns the split into limbs; the refusal stays.

LN42 nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`axc_apply_section` · executor Organ · 2 u · stands on nothing
Definition of done	THE BUS STOP UNDER LN36, SPECIFIED FROM THE SOURCE RATHER THAN LEFT AS A COMPLAINT. Today a writable static may only be ZERO-initialised: x86ctx_emit_module_globals emits a loud invalid line for any non-zero one because .rodata is read-only on the GNU lane and nxasm maps .data (and .bss) to section id 2 = IGNORE (axc_apply_section, nxasm_x86.nx:1051-1064). But nxasm's section 1 tail is ALREADY WRITABLE -- that is exactly how .lcomm works, and its own comment says 'zero-filled MUTABLE slot ... our single-image model appends to the data tail' -- so .data is a both-lanes-correct emission that was simply never taught. Done when: axc_apply_section maps a bare .data and .section .data to section 1; x86ctx_emit_module_globals emits .data + .Lg<id>: + a .byte list for writable non-zero globals in a SECOND pass after the rodata stream (so output stays byte-identical when no such global exists, which nx_cc_equiv_gate proves); a gate compiles a fixture with static x: i64 = 42, WRITES to x and reads it back, with a neg-control that the pre-fix compiler refuses it; and the toolchain promote is canaried. Unblocks the three organs already carrying the workaround by name (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib) and every future dual-target module
Matrix cell	NO-MATRIX-ROW — no matrix row carries `axc_apply_section`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land THE GAP IS CLOSED IN SOURCE AND PROVEN ON THE LAPTOP FARM. nxasm_x86 axc_apply_section now maps a bare .data AND .section .data to section 1 (the DATA TAIL) instead of the ignore bucket -- the one fact that made a writable non-zero static unemittable on either lane. nx_x86_64_ctx gained x86ctx_global_nonzero and emits every writable non-zero global as .data + .Lg<id>: + a .byte list in a block placed BEFORE the rodata stream (cursor 0 is aligned) with each entry padded to the next 8-boundary (always a full 8 when already aligned, deliberately: the content loop emits a trailing comma after every byte, so a zero pad would leave a bare .byte -- the empty-literal miscompile this file already carries a witness for). The G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES refusal is retired; only all-zero writable globals still take .lcomm and that path is byte-for-byte unchanged. 2026-09-03 lesson A SOURCE HUNK'S BACKSLASH-n ESCAPES ARRIVE ON THE NAS AS REAL NEWLINES, SO A LANDED SOURCE IS NOT BYTE-EQUAL TO THE ONE YOU PROVED. Measured here: the landed emitter reads 210068 B against the proven local 209993, and reading the region back shows out_str(o, " .data\n") rendered with an actual line break inside the string literal. This dialect PERMITS a literal newline in a string so the two are semantically identical and it compiles the same -- but every local-vs-NAS hash comparison across that transport will differ even when the change is right, and any byte-identical claim made across it is unsound. ⇒ compare landed source by READING THE REGION, never by hashing it against the local copy, and treat a size delta after a hunk write as expected rather than as evidence of a bad write. 2026-09-03 measure PROVEN THREE WAYS with the freshly built pair, none of it asserted: (1) the new compiler emits ZERO refusal lines and exactly one .data directive for a fixture carrying static answer: i64 = 42 and static tag: i64 = 1234567, the entry reading .Lg10: .byte 42, 0,0,0,0,0,0,0 then eight pad bytes; (2) the new assembler accepts it (rc=0, 7320-byte ELF) and the fixture RUNS returning 0 -- which it can only do if the initializer survived (a0==42), the slot is WRITABLE (a1==43 after a write) and the second static is intact (1234567), each with its own distinct non-zero exit code; (3) NEUTRALITY: nx_wasm_pong assembles BYTE-IDENTICAL between the old promoted compiler and the new one, so the .data block is skipped entirely when no such global exists. The standing witness is runtime/nx_ln42_probe.nx, landed beside nx_empty_lit_probe. 2026-09-03 queue THE TOOLCHAIN PROMOTE IS DELIBERATELY NOT DONE. Both sources are landed on the NAS and read back correct, and the change is proven on the laptop farm, but a compiler goes live only through /api/promote_toolchain with its canary, and the NAS build to feed that canary is storm-refused and QUEUED (nx_build_admit, I/O storm). Remaining, in order: let the queued nx_compile_x86 build fire, build nxasm_x86_main, run the fixture against the NAS-built pair, then promote_toolchain (canaried, .prev-banked, auto-rollback) and re-promote the serving root -- two artifact roots means two promotes. ⚠nx_cc_equiv_gate reads RED (rows=10 passed=0) but it is the estate's documented MUTATION oracle that is vacuous without a challenger; the neutrality evidence that counts is the direct old-vs-new asm comparison above, and a whole-corpus sweep of it was started and did not finish. 2026-09-03 measure NEUTRALITY, AT THE STRENGTH IT ACTUALLY EARNS: a whole-corpus sweep compiling every buildroot/runtime source with the OLD promoted compiler and the NEW one and comparing bytes reached 4932 of 12057 files before hanging on nx_fx_f64_elide.nx -- 4714 BYTE-IDENTICAL, 127 unbuildable by both (SKIP), 91 flagged DIFF. EVERY DIFF SAMPLED (nx_adhd_gate, nx_bills_gate, nx_codegrep, nx_accommodate_gate, nx_access_research_fetch -- 5 of 91) ADJUDICATES IDENTICAL WHEN RE-RUN SERIALLY: each produces ZERO bytes from BOTH compilers, i.e. it does not compile standalone and should have been a SKIP. ⇒ the DIFF column measures the SWEEP'S OWN CONTENTION, not the compiler: 24000 invocations of two ~900 KB compilers under load, through SHARED temp files, in the documented nondeterministic-failure class. The honest claim is therefore 4714 modules proven byte-identical and no adjudicated semantic difference -- NOT zero differences, and NOT whole-corpus coverage. 2026-09-03 lesson A SWEEP THAT SHARES TEMP FILES MEASURES ITS OWN CONTENTION AND PUBLISHES IT AS A FINDING ABOUT THE SUBJECT. My neutrality sweep wrote every comparison through one o.s and one n.s; a stray reader (my own concurrent spot-check) and load-induced nondeterministic compile failures both land as DIFF rows that look exactly like real semantic differences. Worse, my first attempt to ADJUDICATE those rows ran WHILE THE SWEEP WAS STILL COMPILING, so the adjudication was contaminated by the same cause -- I varied two dimensions at once and briefly believed a correct change had regressed 57 organs. ⇒ give every iteration UNIQUE temp paths, re-adjudicate every non-SAME row SERIALLY with nothing else running before publishing it, and remember the earlier law's twin: the first sweep was killed and produced ZERO output because it buffered to stdout, which is why this one appends durably per row and could be read at all. 2026-09-03 lesson THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- one says are these semantically the same text, the other says are these the same bytes -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears, run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong. 2026-09-03 retract I PUBLISHED A FALSE LAW LAST PASS AND THIS RETRACTS IT: I claimed a source hunk's backslash-n escapes arrive on the NAS as REAL NEWLINES, so a landed source could never be byte-equal to the proven local one. REFUTED by the discriminating experiment I should have run before publishing -- a controlled probe carrying a bare backslash, a backslash-quote and a backslash-u through the SAME nx_fs_write path landed 36 bytes for 36 bytes with every backslash intact. The transport is FAITHFUL; nxmcp builds its body with json.dumps and ensure_ascii=False precisely so it stays that way. THE REAL CAUSE of the 75-byte gap was my own bookkeeping: my extraction script read the files with Python's DEFAULT universal-newline translation (CRLF collapsed to LF) and so reported reconstruct==local, while a raw newline='' read shows old+hunks = 210068 against a local 209993 -- a line-ending difference between my working copy and my reconstruction, NOT a corruption of what landed. Both changed regions on the NAS were read back directly and are correct. ⇒ A FALSE LAW PROPAGATES FASTER THAN A DEFECT, and the cost of this one would have been every future seat distrusting a write path that works. 2026-09-03 lesson THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- is this the same TEXT versus is this the same BYTES -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong.

LN41 The wasm memory is declared on the BUILD LANE so one source builds at a sensor's memory and at a supercomputer's · cell PRESENT · gate NO-GATE-DECLARED

Contract	`watd_atoi` · executor Organ · 1 u · stands on LN33
Definition of done	LANDED 2026-09-03. LN33 let a module declare its memory with statics; a DUAL-TARGET module cannot, because the native lane refuses a non-zero static initializer by name, and it should not have to -- a target's limit is a declared door on a ladder, never a constant in the source. nx_compile_wat --shared <pages_req> <pages_max> moves it to the build lane, --nothreads emits the unshared twin at the same declared size, and absent the flag the WAT is byte-identical. nx_wasm_threads_gate 37/37 GREEN on the NAS; driver promoted 6c6f5f4d, gate promoted 1895335d.
Matrix cell	One source builds at a sensor's memory and at a supercomputer's: the wasm memory is a build-lane door, not a constant in the source · `runtime/nx_compile_wat.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_compile_wat`; declare `nx_compile_wat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure A DUAL-TARGET MODULE CANNOT CARRY THE LN33 MEMORY DECLARATION AT ALL, AND THE PROBE THAT PROVED IT COST ONE BUILD: nx_wasm_craft compiles BOTH natively (its gates import it) and to wasm, and adding static nx_wasm_pages_req/pages_max/shared_req made the native lane emit G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES five times and refuse. ROOT CAUSE READ FROM THE SOURCE, not guessed: nx_x86_64_ctx.nx x86ctx_emit_module_globals refuses a WRITABLE NON-ZERO static because .rodata is read-only on the GNU as/ld lane and 'nxasm IGNORES .data sections wholesale (nxasm_x86.nx:810)', leaving .lcomm (zero-fill only) as the sole both-lanes-writable form. The workaround is already documented in THREE other organs (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib), so this is a recurring gap with a measured cost, not a one-off 2026-09-03 lesson A STAGED ARTIFACT IS INERT BY CONSTRUCTION, SO nx_behaveprobe ON A STAGE SLOT REPORTS other_rc=127 other_bytes=0 DIFFERS FOR A PERFECTLY GOOD BINARY. content_put writes the .new without an execute bit and /api/promote is what sets the mode, so the probe exec'd a non-executable file. Read as a verdict it says 'the candidate is broken'; read correctly it says 'you probed a file nothing can run'. The promoted binary then ran 32/32 and 37/37 on the NAS. ⇒ for a laptop-shipped artifact, promote (which sets the mode) and verify by RUNNING it, or the probe indicts the wrong subject 2026-09-03 lesson A HAND-COUNTED LENGTH BESIDE A STRING LITERAL TRUNCATED THREE REFUSALS AND THE GATE CAUGHT IT: I passed watd_log(msg, 58/55/69) for messages that are 60/57/71 bytes, so every --shared refusal printed a CUT string. The refusals fired correctly and the teeth searching for their text failed -- the defect was invisible in behaviour and visible only in the assertion. Fixed by DERIVING the length (watd_logs walks to NUL). This is the estate's own banked law and I broke it anyway; the tooth is what made it cost minutes instead of a session 2026-09-03 lesson RUNG IDS COLLIDE ACROSS CONCURRENT LANES ON A SHARED BOARD AND NOTHING CHECKS: I appended a rung as LN37 and four log rows as LN36, and BOTH ids were already taken by another lane's rungs landed the same day (LN36 decimal exponent literals, LN37 the f64 ordered-compare fix). The board accepted the duplicates silently -- a plan with two rungs sharing an id is the same coin-flip-wearing-a-schema defect organ_kind.conf was caught with, and the ranker reads whichever it matches first. Renumbered mine to LN41/LN42 after grepping for free ids. ⇒ GREP THE BOARD FOR THE ID BEFORE APPENDING A RUNG, and the durable fix is a uniqueness tooth in the compare referee rather than a habit. 2026-09-03 measure The census made this class visible and then measured the fix: 40 programs refused with "I do not know the name K_MAGIC_65536", a name that IS declared on nx_crash.nx line 2. Every one was a single unbalanced brace in the program itself. After LN41, 40 of 40 name their own opening brace with file, line and caret -- other=0. Positive control: a healthy program still compiles unchanged (nx_quadrature_gate, rc=0, 153801 bytes of assembly). 2026-09-03 lesson ★★★★★★A STRUCTURAL BREAK REPORTED AT THE PLACE IT SURFACES SENDS EVERY READER TO A FILE THAT IS NOT THE PROBLEM. The token stream knew exactly where the brace was opened the whole time; nothing had to be inferred, only said. The tell that it was structural and not a missing symbol was the diagnostic pointing its caret AT a const declaration while claiming the name had no definition, plus a following error quoting comment prose as code. 2026-09-03 lesson This class was invisible to every gate for the same reason the 0x0E class was: ★A SOURCE THAT CANNOT COMPILE RUNS NO TEST, SO ITS SILENCE READS AS HEALTH. Two of the three largest defect classes in the estate were only findable by compiling the whole population, which is the argument for nx_langcensus existing at all. 2026-09-04 queue A FRONT-END FIX LANDED IN SOURCE BY A LANE THAT DIED BEFORE REPORTING IT, FOUND BY A 4147-BYTE PARSER DIVERGENCE DURING A SHIP (2026-09-04). runtime/nx_parse.nx 433947 -> 438094 B: (1) lookup_enum_type -- a PLAIN enum name (no payload) used in a TYPE position resolves, where before it died as I do not know a type named X; a tagged enum already resolved through its shadow struct, so only payload-free enums were value namespaces that could not be NAMED in a signature, and Result<i64, NetError> did not compile -- measured on runtime/nx_net.nx (8 errors) and runtime/fs.nx (10). (2) A CODEGEN DEFECT in the variant constructor: it returned the alloca id, which is a SLOT, and every as-VALUE consumer dereferences a slot, so return Result::Ok(v) compiled to a load of the shadow's first word and returned the TAG -- Ok(x) came back as 0, indistinguishable from null, Err(x) as 1, a bogus non-null pointer; fixed by emitting a GEP at offset 0 AFTER the stores so the caller receives a materialised address, the sibling half of the bug already fixed in x86ctx_emit_gep. STATUS, MEASURED BY THE SEAT: the fix lives in the parser SOURCE that library-importing organs compile in (nx_wgsl rung 2 links nx_parse and reads 105/105 and 39/39 with it), but the INSTALLED TOOLCHAIN is a prebuilt binary that does not carry it -- nx_net still refuses with 10 errors on the laptop, and nx_cdp_eval, rewritten by the same lane to compose nx_net, is therefore currently UNBUILDABLE. ⇒ UNPROVEN FOR ITS PURPOSE until the toolchain is rebuilt from this parser through the sanctioned lane (nx_cc_equiv_gate 10/10 + self-host GREEN + canary), which the laptop-farm lane must never do. The parser SOURCE is shipped to the NAS under CAS so that source and the nx_wgsl binary agree (a served binary carrying code its source cannot rebuild is the AHEAD class). ACCEPT RULE for the toolchain rung: nx_net compiles clean, a KAT proves Result::Ok(v) returns a pointer whose first word is the tag and not the tag itself, and nx_cdp_eval builds and passes its refusal paths and round trip.

LN43 Bounds-check elision with a cost model · cell WATCHING · gate NO-GATE-DECLARED

Contract	`bck_elide_cost_model` · executor Organ · 3 u · stands on LR7
Definition of done	The modulo arm of nx_bck_elide_gate is GATED rather than merely published, elision is DECLINED on shapes that measure slower, and the div-free win is preserved at or above 1.9x across three sequential rounds on the live compiler
Matrix cell	RETRACTED-SEE-NOTE Bounds-check elision cost model · `runtime/nx_bck_elide.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bck_elide`; declare `nx_bck_elide TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 retract WITHDRAWN BY ITS AUTHOR, SAME DAY IT WAS FILED. The modulo regression (3-10 percent, 3 rounds) was NOISE: those rounds ran on the NAS with a degraded write path where that arm's own run-to-run spread was 27 percent, so a consistent direction over three samples was inside the noise band. Quiet-host re-measure, 15 interleaved rounds: div-free 8275 vs 5210 us (1.59x WIN), modulo 45807 vs 44851 us with ranges OVERLAPPING (neutral). No cost model is needed and no shape must be declined.

LN45 An unclosed brace is reported where it was opened · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nxcx_brace_balance` · executor Organ · 1 u · stands on nothing
Definition of done	LANDED 2026-09-03. A single missing closing brace made every later declaration parse INSIDE that block, so the module-level const on line 2 of nx_crash.nx -- the crash handler the builder APPENDS to every program -- read as an assignment and the whole cascade was attributed to a file the author never wrote. The driver now walks the TOKEN stream after lexing (so a brace inside a string or comment cannot confuse it), remembers the OUTERMOST still-open brace, and refuses with a caret on it, the depth, and the reason the errors would otherwise surface elsewhere. A stray closer gets its own message.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nxcx_brace_balance`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN44 The build lane declares its compile mode · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cb_mode_policy` · executor Organ · 3 u · stands on LR7
Definition of done	The mode organs are compiled with is DATA read by the build lane, not an omission; a target moved to the f1 bundle is proven output-identical by nx_behaveprobe before the move, and the published h2h receipt shows the default arm closing on the f1 arm
Matrix cell	The estate builds itself in its FASTEST proven-sound mode, not its slowest · `runtime/nx_ccbuild_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ccbuild_lib`; declare `nx_ccbuild_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure THE ESTATE COMPILES EVERY ORGAN IN DEFAULT MODE -- no build lane passes --mode. Default has --bckelide OFF, so the estate ships its slowest mode by omission while f1 is proven sound (13/13) and measures 1.59x locally and 7105 vs 4189 us on the receipt. At 4189 us f1 BEATS rustc -O checked (4445) and ties Go (4163); the default we ship trails both by 1.7x. 2026-09-03 lesson A CONSISTENT DIRECTION ACROSS THREE SAMPLES IS NOT A FINDING WHEN THE INSTRUMENT'S OWN SPREAD IS FOUR TIMES THE EFFECT. I published a 6 percent regression measured on a box whose spread was 27 percent. The discriminating move was not more rounds on the same host -- it was a QUIETER HOST with a minimal fixture, where the effect either survives or dissolves. It dissolved, and chasing it would have bought a cost model for a phenomenon that does not exist. 2026-09-03 queue THE FIX IS A BUILD-LANE POLICY, NOT A COMPILER DEFAULT, AND THE REASON IS THE UNDO PATH: nx_compile_x86's default-OFF contract keeps default builds byte-identical, which every drift and contentdiff instrument depends on. Flipping it estate-wide re-baselines all of them at once, so the comparison surface needed to judge the change would be destroyed by the change. Stage it per-target through the build lane with nx_behaveprobe proving output identity first. 2026-09-03 measure THE 1.696x ELISION WIN IS UNREACHABLE FROM THE BUILD QUEUE AND THE CAUSE IS A PATH, NOT THE PASS. nx_compile_x86.nx read its mode table from ONE bare CWD-relative literal knowledge/lang_modes.conf, declared at line 120 and read at exactly one site, line 143 (nx_shelltool grep NXCX_MODES_CONF over buildroot/runtime returns matches=2 coverage_complete=1 corpus_complete=1). That file exists ONLY at buildroot/knowledge/lang_modes.conf, 1907 B; knowledge/lang_modes.conf is ABSENT from the serving root. The build QUEUE starts in the serving root, so a --mode=f1 build issued from the queue could never resolve the conf and would REFUSE, while the identical command from buildroot succeeded. CORRECTION TO THE BRIEF THIS LANE WAS GIVEN: the refusal exit is 9 (NX_COMPILE_X86_BAD_MODE), NOT 111 -- the 111 is the dead length argument of nxcx_log, which LN27 had already made untrusted because the function recomputes the length itself. 2026-09-03 land MODE-CONF RESOLUTION FIXED BY COMPOSING THE INCUMBENT RESOLVER RATHER THAN WRITING A SECOND ONE. nx_compile_x86.nx 39544 B sha 2237f186 to 42406 B sha 7a34a429 in six CAS edits, every one verified by predicted byte delta. It now calls ct_readall_2dir from nx_comparetree_lib with its OWN dirs (position 1 knowledge/ and position 2 buildroot/knowledge/), which sizes its buffer from the file so it cannot short-read, and writes which position answered on EVERY path INCLUDING the miss. Only the GENERIC 2dir primitive is used, never the /compare wrappers, so the compare-side order adjudication cannot reach the compiler. The winning root is ANNOUNCED on the success path too, on stderr never stdout, because the two knowledge trees are FORKED rather than copies and a silent pick between two lang_modes.conf files would expand a mode from the one nobody was looking at. COMPILE-PROVEN: the laptop copy was made byte-identical to the NAS (both sha 7a34a429, 42406 B) and nx_sov_build_run --build-only returned rc=0 with an 866180 B artifact. 2026-09-03 lesson A REFUSAL GUARDED BY A FLAG NOBODY PASSES YET IS A LANDMINE RATHER THAN A BUG -- IT CANNOT FIRE UNTIL THE DAY SOMEONE ADOPTS THE FEATURE, WHICH IS THE DAY IT COSTS THE MOST. The acceptance bar is therefore structural and not empirical: nxcx_expand_mode is the only reader of the conf and has exactly ONE call site, guarded by if nxcx_is_mode_flag(marg) == 1, so a build passing no --mode= never opens the file and can never refuse; and position 1 is the incumbent literal byte for byte, so ct_readall_2dir returns the same bytes for every CWD that resolved before and consults position 2 only where the old code had ALREADY refused. A refusal can become a success and a success cannot become a refusal. 2026-09-03 queue BUILD QUEUED, NOT LANDED, ON THE NAS. /api/build target=nx_compile_x86 was REFUSED by nx_build_admit and the build did NOT run; the enqueue returned queue_launch_rc=0 queued=1 row BQ-nx_compile_x86, so it fires on the first nx_orchestrate pass with headroom. THE REFUSAL DESTROYED THE _build FOSSIL -- nx_catalog read BUILT yes 957128 B before and BUILT NO after, the runner reporting no artifact at buildroot/_build/nx_compile_x86.sov.elf -- so every staleness comparison against that path is measuring an absence until the queued build lands. nx_compile_x86 is TOOLCHAIN and must move via /api/promote_toolchain with its canary, never a plain promote; this lane deliberately did NOT promote it. 2026-09-03 lesson THE TASK-3 PREMISE THIS LANE WAS BRIEFED ON WAS ALREADY REFUTED ON THIS BOARD BEFORE I WROTE A LINE. I was told elision is a REGRESSION on modulo shapes (102547 to 112529 us, minus 9.73 percent) and that the missing piece is an LN43 profitability heuristic. The sibling row log 1788476600 LN43 retract, filed minutes earlier by its own author, WITHDRAWS exactly that: on a quiet host over 15 interleaved rounds the modulo arms OVERLAP (45807 against 44851 us) and the apparent effect sat inside a 27 percent instrument spread. So NO cost model is required, LN43 is retracted, and the live rung is LN44. My four rows above were filed under LN43 and were RE-KEYED to LN44 in one all-occurrences edit; that edit returned 503, had in fact LANDED, and only a CONTENT read could tell, because LN43 and LN44 are the same length so the byte size was identical either way. LINKAGE WORTH STATING: the mode-conf resolution fix is the PRECONDITION for LN44's own done-rule -- a build lane cannot declare --mode=f1 from the queue while --mode= REFUSES from the queue, which is what the bare CWD-relative conf path guaranteed. READ THE BOARD BEFORE ACTING ON A BRIEF: a briefing is a snapshot, and this one was stale on a board that moves by the minute. 2026-09-03 land MECHANISM SHIPPED, WIRING NEXT. nx_buildmode_lib (7900 B) makes the compile mode DATA -- knowledge/build_modes.conf rows target 2026-09-03 measure THE SAFETY PROPERTY IS THE LOAD-BEARING TOOTH AND IT HOLDS: with no conf present the reader returns absent_conf_flags=0 AND absent_conf_keylen=0, so adopting this lib cannot change one byte of one artifact, and every existing build-cache entry stays valid. There is no flag day. A row is what changes behaviour, and only for the target it names. 2026-09-03 lesson THE CACHE KEY WAS THE TRAP AND IT WAS NEARLY MISSED. nx_sov_build_run caches artifacts under sha256(expanded closure ++ compilerSha ++ asmSha ++ g-or-n). A mode that changed emitted code WITHOUT entering that key would serve an artifact compiled under the OTHER mode and present it as a cache hit -- silently correct-looking and wrong. bm_key_token exists so the mode enters the key by construction, and the gate asserts two modes can never share one. Read what a cache keys on BEFORE adding an input to the thing it caches. 2026-09-03 queue WIRING IS THREE SITES IN nx_sov_build_run, all named: the cache key at sbr_cache_key (line 429, where want_debug already contributes g-or-n), the compiler argv at line 1406 (where -g is already appended), and one import. The proof that gates the wiring is BYTE IDENTITY: with no conf present, a target built by the wired runner must hash identical to one built by the unwired runner. That is the experiment to run before it ships, and it is cheap.

LN46 Every parser refusal carries a location, a caret and a fix · cell LANDED · gate NO-GATE-DECLARED

Contract	`nx_diag_organ_at` · executor Organ · 1 u · stands on nothing
Definition of done	LANDED 2026-09-03 (symbol repointed 2026-09-27 from the never-built name nx_pd_line to the real entry point nx_diag_organ_at in runtime/nx_parse.nx, so the contract stops reading UNMAPPED). parse_die and two sibling raw-write refusal sites printed a bare one-line sentence with no file, no line, no caret and no fix -- 35 call sites in all. nx_diag_organ_at had existed since the file-attribution pass, waiting for a line number that parse_die never had. Every token in the unit passes through advance_tok, so recording line and col at that ONE chokepoint gives every site a truthful location without touching a single call site; a site reached before any token was consumed keeps the bare form rather than pointing at line 0.
Matrix cell	Every parser refusal carries a location, a caret and a fix (lang LN46) · `runtime/nx_parse.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD4 Refuse first and name the rule: every refusal carries the rule that fired adopted
Work log	2026-09-03 measure Measured over the whole class in the census baseline: parse_die refusals carrying file and line went 0 to 24 (parse_die itself), then to 43 (the unhandled-intrinsic site), then to 46 with still_bare=0 (the forward-const site). Toolchain b89d609234304148 canary GREEN. Example: a bare "unknown identifier in const-expression" became nx_arena_smp_gate.nx:38 with the source line and a caret on NX_MAGIC_2000000000 -- which is itself the next defect, a hoisted const that was never declared. 2026-09-03 lesson ★★★★★A DIAGNOSTIC WITHOUT A LOCATION IS A SENTENCE, NOT A DIAGNOSTIC -- AND IT IS ALSO UNGROUPABLE, SO IT HIDES ITS OWN FREQUENCY FROM EVERY CENSUS THAT WOULD HAVE RANKED IT. These 90 refusals sat in one blank class called "no recognised diagnostic marker" precisely because there was nothing in them to key on. Fixing the voice made the class countable, and counting it surfaced the __q4k_sb_dot unwiring underneath. 2026-09-03 lesson The unhandled-intrinsic refusal now distinguishes two absences that need OPPOSITE actions and used to share one word: an intrinsic whose emitter exists but whose NAME was never routed is BUILT AND UNWIRED (fix the one missing line), while an intrinsic with no emitter anywhere is NOT IMPLEMENTED (the program is asking for a feature that does not exist). Measured the same day: __q4k_sb_dot was the first, __simd_vload_i64_x4 and __simt_thread_id are the second and are correctly refused. 2026-09-03 lesson Two hand-counted string lengths (52 and 68) sat beside their literals at the forward-const site, the exact drift LN27 removed elsewhere; nx_diag_puts measures the string itself. ★A HAND-COUNTED LENGTH BESIDE A LITERAL IS A SECOND COPY OF THAT LITERAL SHAPE AND THE TWO DRIFT SILENTLY.

LN13a The wat lane refuses what it cannot lower · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`wat_die_unlowerable` · executor Organ · 1 u · stands on LB0
Definition of done	LANDED 2026-09-04. The precondition under LN13, and it is worth a rung on its own because it closes a silent-miscompile class that existed with no closures anywhere. The wat backend answered an IR opcode it had no arm for with a WAT COMMENT and return 0, without storing a result local, so the module assembled, instantiated and RAN while computing zero at that instruction. Only 41 of the 141 declared opcodes have an arm in that emitter and OP_CALL_INDIRECT 144 was one of the 100 that did not, which is what every function-pointer call lowers to. Done when a function-pointer call through nx_compile_wat is refused BY NAME with its opcode number and emits no module, an ordinary direct call still compiles byte-identically, and both are bound in a gate that goes RED against the pre-fix binary.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `wat_die_unlowerable`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-04 land SHIPPED AND PROVEN ON THE DEPLOYED ARTIFACT. wat_die_unlowerable added to BOTH emitter twins nx_wasm.nx and nx_wasm_scalararm.nx, composing the incumbent wat_die so the file keeps exactly ONE exit path, and scoped to the no-arm fallthrough ONLY. The OP_SYSCALL arm above it still emits i64.const 0 and still stores its result, because that no-op is DECLARED behaviour for non-mmap syscalls and shipped modules pass through it harmlessly; the rule is no arm at all, never an arm I judge incomplete. Sources landed on the NAS hash-verified against the laptop, nx_compile_wat promoted a811c7f0a5a26dca at 646721 bytes with prev banked, gate nx_wat_refuse_gate promoted b09ead8e07fbffb8 at 38663 bytes and REGISTERED, and the gate then ran ON THE NAS against the LIVE compiler at 14 of 14 GREEN. 2026-09-04 measure NEUTRALITY AND THE BITE, BOTH MEASURED, NEITHER ASSERTED. Whole-population sweep of every wasm-targeted source in buildroot runtime with the pre-fix and post-fix compilers: population 85, identical 84, differs 0, refused 1, and the partition sums to 85. The shipping beach module nx_wasm_craft.nx emitted 10045460 bytes BYTE-IDENTICAL across both compilers. The single refusal is nx_video_codec_v1_adapter.nx at opcode 144 in nx_codec_encode, which is a REAL pre-existing silent miscompile and not a regression: nx_codec.nx line 115 calls through the encode_fn vtable slot declared on line 86, so every codec encode through the wasm lane silently returned zero while the build exited 0. Nothing feeds that adapter to the wat lane today so no live build breaks. The promote ruler read lost_from_live 4 with lost_srcpath 0, and all four are adjudicated: three are parser diagnostics superseded by strictly richer replacements visible in the GAINED list, and the fourth is the silent marker itself, whose removal IS the deliverable. 2026-09-04 lesson A BUILD FOSSIL IS NOT A FRESH MEASUREMENT, AND IT NEARLY SENT ME AT THE WRONG OPCODES. My first refuting experiment found the silent marker PRESENT in three emitted artifacts at opcodes 46 and 47, which reads as proof that a blanket refusal would break shipping builds. Both are atomics, OP_ATOMIC_STORE_I64 and OP_ATOMIC_CAS_I64, and the current emitter dispatches all five atomic ops at lines 584 to 588: those .wat files are pre-LN33 fossils in _build, emitted by a compiler that predates the arms. The evidence was true and its subject was stale. Re-emitting rather than reading fossils is what turned a false blocker into the real finding at opcode 144. 2026-09-04 lesson A TOOTH THAT PASSES FOR THE WRONG REASON IS AS DANGEROUS AS ONE THAT FAILS, AND ONLY THE BITE FOUND IT. My first gate asserted the refusal named its opcode by searching the merged capture for the bare substring 144. That tooth PASSED against the pre-fix compiler, because the silent marker it emits is literally ;; TODO opcode 144 -- so the one tooth meant to convict that binary was satisfied by the very string that proves it guilty. Fixed to the contiguous phrase cannot lower IR opcode 144, after which the pre-fix run moved from 9 of 14 to 8 of 14. A gate that has only ever been run against the fixed binary would never have shown this. 2026-09-04 lesson MY OWN FIRST FLEET CENSUS WAS LESS THAN HALF THE POPULATION AND REPORTED A CONFIDENT ZERO. Paging a job artifact by trusting an empty next= field stopped at the READER's byte cap rather than at end of file, giving 683 rung rows over 67 domains with lang.plan missing entirely, from which the duplicate-rung-id census returned zero collisions. Re-paged with explicit offsets and small windows the real population is 1438 rung rows over 106 domains, lang's 60 rungs present and matching a direct count, and the true answer is 4 collisions in 2 domains. AN EMPTY CONTINUATION FIELD IS NOT PROOF OF EXHAUSTION, and a census that silently stops early fails in the flattering direction.

LN Board-level journal anchor for lang · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`-` · executor Board · 0 u · stands on nothing
Definition of done	BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 5 log rows against the id LN, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `-`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 measure nx_dwline_stmt_gate reads RED 11/13 on the NAS after a rebuild from its source (a sentinel-loop fix in its .debug_line section match, unrelated to the two failing teeth): `neg-control-baseline-LACKS-statement-lines-6-and-10` and `new-row-count-strictly-greater` both FAIL because the BLESSED compiler now emits the statement-granularity .loc rows the gate's neg-control assumed it lacked -- OLD(blessed) L5=1 L6=2 L9=1 L10=2 total=6 equals NEW(stmt) total=6, s_bytes 31830 both. The differential oracle collapsed the day statement granularity was promoted into the toolchain; the gate is now measuring the toolchain against itself. Remedy for the lang lane: turn the neg-control into a pinned pre-statement compiler fixture (or drop the differential and assert the statement rows directly, which teeth 12-13 already do at L6=1 L10=1 from real addresses). Until then this RED is a stale oracle, not a regression. 2026-09-03 land nx_dwline_stmt_gate oracle RE-PINNED and served: the two collapsed differential teeth became `blessed-compiler-CARRIES-statement-lines-6-and-10-the-feature-is-promoted` and `new-row-count-equals-the-blessed-count-both-statement-granular` (with a positive-count neg-control so an empty agreement cannot pass); rebuilt on the NAS 96280e8c, promoted, /api/gate_run 14 of 14 GREEN. The gate now pins that the toolchain KEEPS statement granularity instead of demanding it add what it already has. 2026-09-04 measure NISHILANG COMPILE-HEALTH: THE CONTROL-BYTE REFUSAL CLASS IS VERIFIED CLEAN AT FULL POPULATION (2026-09-04). nx_ctlbyte_repair DRY over the real source roots reports files=19331 affected=0 insert=0 drop=0 unknown=0 sum=0 RECONCILES verdict=CLEAN. That is the whole-corpus confirmation the 2026-09-03 repair never got: that pass fixed 314 sources which could not compile AT ALL and took refusals 747 to 427, and this says the class has not regrown anywhere in 19,331 files. A source that cannot compile runs no test, so its silence reads as health -- which is why this class deserves a population check rather than a spot one. ★★★★★★AND THE RUN BEFORE IT IS THE LESSON, MEASURED IN ONE PAIR OF COMMANDS: invoked with no roots from CWD=nishihost the SAME organ reported files=17 verdict=CLEAN. Same verdict, same wording, same exit -- from a population 1,137 TIMES SMALLER and the wrong tree. A GREEN OVER THE WRONG CORPUS IS BYTE-INDISTINGUISHABLE FROM A GREEN OVER THE RIGHT ONE, AND ONLY THE files= FIGURE DISCRIMINATES THEM. ★CREDIT WHERE THE DESIGN EARNED IT: the organ did NOT hide this. It printed `roots=runtime runtime/_hdl_build (DEFAULT -- name roots explicitly when the CWD is not the source tree)` on its own first line, so the trap was visible in the receipt and cost one re-run rather than a false estate-wide claim. That is the same CWD-relative class this session fixed in nx_swcompare_matrix, and it is the correct handling of it: an organ that cannot know its caller's CWD should ANNOUNCE its assumption rather than silently resolve. ⚠WHAT IS STILL UNMEASURED AND WHY I DID NOT MEASURE IT: the residual 427 refusals from the 09-03 census are NOT control-byte and their causes are unenumerated. Naming them needs nx_langcensus, which COMPILES EVERY top-level program (about 13,721 of them) and is NOT build-admission gated -- so running it during the current degraded-array storm would route hours of compile I/O around the very governor protecting those disks. DEFERRED DELIBERATELY, not forgotten, and the cheap unblock is named: the census takes an explicit <cc.elf> and REFUSES to guess a compiler (a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape as above), so it can be run on the idle laptop farm against buildroot/_offc/nx_cc_sovereign.elf the moment either the array recovers or a seat has hours to spend. 2026-09-04 measure WHOLE-POPULATION NISHILANG COMPILE CENSUS, RUN AND RECONCILED (2026-09-04). LANGCENSUS programs=13784 ok=13377 err=400 hang=7 harness=0 sum=13784 RECONCILES rows_written=547305, verdict=NO-REGRESSION with the organ correctly declaring itself a BASELINE rather than a judgement because no prior census was given. So 407 programs cannot compile at all, against the 427 the 2026-09-03 pass left behind. ⚠SCOPE LABELLED, NOT GLOSSED: this is the LAPTOP corpus at 19,458 files, not the NAS tree, so the 427-to-407 movement is NOT a proven improvement -- the two populations are not known to be identical and I did not compare them. What IS proven is the partition: every one of 13,784 programs landed in exactly one class and the sum reconciles. WHY IT RAN ON THE LAPTOP AT ALL: nx_langcensus COMPILES EVERY top-level program and is NOT build-admission gated, so running it on the NAS during the current degraded-array storm would have routed hours of compile I/O around the very governor protecting those disks. It ran instead on 16 idle cores against buildroot/_offc/nx_cc_sovereign.elf at ZERO NAS cost, which is the laptop-farm lane doing exactly what it was built for. ★CREDIT TO THE ORGAN'S OWN DESIGN: it REFUSES to guess a compiler, because a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape that made a 17-file ctlbyte scan and a 19,331-file one print the identical CLEAN verdict earlier today. THE WORKLIST IS RANKED AND ONE CAUSE DOMINATES: `this block is opened here and never closed` at n=51 is roughly an eighth of every error in the estate from a SINGLE class, and LN41 already made that diagnostic name its own brace, so these 51 are precisely located rather than hunted. Behind it: undefined names (a long tail of n=1, each a genuinely missing symbol), ARITY MISMATCHES that are real call-site defects (wm_run called with 7 where it takes 8, vv_deblock and vv_deblock_plane with 4 where they take 5, ss_build_terms with 4 where it takes 5), 9 sites that compute a value and never use it so the work is thrown away, and DUPLICATE DEFINITIONS including nx_ts_verdict_is_valid defined THREE separate times at lines 6635, 6672 and 7691. ★★★★★★THIS IS THE LARGEST REFUSAL CLASS IN THE ESTATE AND IT IS INVISIBLE TO EVERY GATE BY CONSTRUCTION: a source that cannot compile runs no test, so its silence reads as health. 407 programs are currently contributing exactly nothing to any green anywhere, and until today nobody could name one of them. OWED: re-run against the NAS corpus when the array recovers and pass THIS run as the baseline argument, which turns the census from a snapshot into the regression detector it was written to be. 2026-09-04 retract PARTIAL RETRACTION OF THE CENSUS I JOURNALED TWENTY MINUTES AGO, WITH A CONTROL IN BOTH DIRECTIONS. I published programs=13784 ok=13377 err=400 hang=7 and labelled it LAPTOP corpus, which was the right hedge, but I then treated the 51 unclosed-brace rows as a worklist of ESTATE defects. THEY ARE NOT ALL ESTATE DEFECTS AND I CAN NOW PROVE IT BOTH WAYS. NEGATIVE CONTROL, a row that is NOT a real defect: nx_rv64_amo_gate.nx measured 8335 bytes on the laptop against 7491 on the NAS. Pulling the NAS copy and recompiling it with the SAME compiler produced a clean run -- nx_dce functions=287 live=141 pruned=146, no brace error at all. The ERR belonged to the LAPTOP COPY, not to the estate. POSITIVE CONTROL, a row that IS real: abr_t2.nx is 773 bytes on BOTH sides, byte-for-byte the same size, and its tail ends mid-token on the bare characters `std` -- a genuinely truncated source that is broken in the estate itself. ★★★★★★SO THE CENSUS IS A VALID MEASUREMENT OF THE CORPUS IT SCANNED AND AN INVALID ESTATE FIGURE, AND THE DIFFERENCE IS INVISIBLE FROM THE OUTPUT: every ERR row looks identical whether its cause is a real defect or local rot in a stale mirror. ATTRIBUTION IS PER FILE AND THE PROCEDURE IS CHEAP NOW THAT THE INBOUND DOOR EXISTS -- pull the NAS copy, recompile, and compare; roughly twenty seconds each. ⚠THE TRAP THIS AVOIDS IS SPECIFIC AND EXPENSIVE: 51 rows presented as a fix-list would have sent the next seat editing sources that are ALREADY CORRECT ON THE NAS, and every such edit would have shipped laptop rot INTO the estate under the banner of fixing it. A STALE MIRROR PRODUCES ERRORS THAT ARE INDISTINGUISHABLE FROM DEFECTS, AND THE ONLY DISCRIMINATOR IS A FRESH PULL. WHAT SURVIVES UNCHANGED: the partition still reconciles at 13784, the census organ behaved correctly throughout, and the class RANKING is still the useful output -- unclosed-brace dominating at n=51 is a real signal about where errors cluster even when individual rows need attribution. WHAT IS OWED, and it is now the only honest way to get an estate number: re-run the census against the NAS corpus when the array recovers, passing this run as the baseline argument. Until then NO estate-wide refusal count should be quoted from it, including by me. 2026-09-04 measure THE 51 UNCLOSED-BRACE ROWS ARE ATTRIBUTED AND THE PARTITION RECONCILES, WHICH DISCHARGES WHAT MY RETRACTION LEFT OWED. ATTRIB51 declared=51 examined=51 banked=51 compiles_after_pull=43 still_err=7 pull_failed=1 sum=51. Method: bank the laptop copy, pull the NAS copy over it through the inbound content lane, recompile with the same compiler, classify. So the estate has SEVEN unclosed-brace sources, not fifty-one, and 84 percent of that census class was stale laptop mirror exactly as the negative control predicted. The seven real ones are abr_t2.nx, nx_antipattern_catalog.nx, nx_fbo_s2.nx, nx_flg_t2.nx, nx_frp_t1.nx, nx_delivery_report.nx and nx_gen_authz_gate.nx. The single PULL-FAILED row is nx_vcodec_dct2_rd_gate.nx, answered CG-IO cannot open source, i.e. a laptop-only file absent from the NAS entirely -- it stays in its own bucket rather than being folded into either real class, because a row you could not attribute is not a row you may count. ROOT CAUSE FOUND AND IT COLLAPSES 42 OF THE 43: those files carry the marker MIGRATED onto nx_gate_verdict by nx_gate_dry_apply, and the D001 minimal-form substitution is defective in TWO ways at once. It leaves the gv_verdict call INSIDE the enclosing if pass==1 block, CONSUMES that block's closing brace so the function is never closed, and DELETES the RED emission branch outright. Proven by reading the source, not inferred from a diff: in nx_gen_authz_gate line 40 opens if pass==1, line 50's brace closes THAT, and main is never closed, which is why the compiler names line 21. A sibling still on its pre-migration NAS copy retains g_puts verdict=RED at line 77 while the migrated copy contains the string zero times. ★★★★★★THE LOUD HALF OF THAT DEFECT IS WHAT STOPPED THE SILENT HALF FROM SHIPPING. Had the brace arithmetic been right, these gates would compile and print NOTHING AT ALL when they fail -- a gate whose exit code and output both vanish on the RED path -- and nobody would have found it by reading a green board. The compiler refusing is the only reason 42 of 43 never reached the estate. ONE DID REACH IT: nx_gen_authz_gate was broken ON THE NAS and could not build at all. FIXED AND SHIPPED THIS SESSION, not filed: hand-migrated onto PER-TOOTH gv_check rather than restoring the pre-migration copy, because the machine form set ctr[0]=pass and ctr[1]=1, and a one-state judge reports passed 1 of 1 and cannot say which conjunct dropped. It now runs 5 of 5 GREEN with both deny cases named neg-control- so the L2 census can see them, emits five values through gv_kv for independent adjudication, and carries its verdict in its exit code. NAS artifact verified at 3859 bytes, not trusted from the receipt -- nx_fs size still served the pre-write 2928 for a minute afterwards, the read path lagging the write path on this surface too. 2026-09-04 retract PRECISION AND ONE SELF-INFLICTED CENSUS ERROR ON THE ROW ABOVE, PLUS THE SILENT-DEFECT SCARE RESOLVED TO NOTHING. FIRST THE ERROR, BECAUSE IT IS THE INSTRUCTIVE PART. I sized the migrated population by grepping the marker AFTER the attribution run had already pulled 43 NAS copies over their laptop twins. Those NAS copies are PRE-migration and carry no marker, so the very files whose defect I was measuring had silently left the population, and the sweep returned MIGSWEEP examined=841 compiles=834 brace_broken=1 -- a reassuring number produced by a census whose reference I had re-baselined myself, one hour earlier, with my own repair. ★★★★★★A CENSUS RUN AFTER A REPAIR MEASURES THE REPAIR, NOT THE DEFECT, AND IT FAILS IN THE FLATTERING DIRECTION. Reconciled against the banked originals the true population is 885 = 841 surviving on disk + 44 banked pre-pull, and the brace-break rate is 44 of 885, about 50 per thousand. That partition closes exactly: of the 44, 42 have clean pre-migration copies on the NAS so the broken migration never shipped, 1 is nx_gen_authz_gate which DID ship and is now fixed, and 1 is nx_vcodec_dct2_rd_gate which the inbound door answered CG-IO cannot open source, i.e. laptop-only. 42 plus 1 plus 1 is 44. SECOND, THE SCARE I DID NOT PUBLISH AND WHY. Having found that the migration deletes the RED branch, I suspected a fleet-wide SILENT defect: gates that compile but emit nothing when they fail. A first-draft 12-line context grep answered 217 files. I refused to publish it and tested it properly, and both refinements collapsed. A brace-depth counter over all 841 returned 28 non-conforming files, but it also returned NEGATIVE depths, which is a counter telling you it cannot parse -- braces inside string literals. Hand-adjudicating two of the 28, nx_library_gate and nx_media_state_gate, found the gv_verdict call sitting unconditionally at the end of main in BOTH: two hits, two false positives. So no count is published for that class at all. ★★★★★★THE DETECTOR ALSO MATCHED ITS OWN NEEDLE -- nx_gate_dry_apply.nx appears in its own suspect list because the tool carries the marker as a template literal, the same self-counting defect the gatelaw census hit. WHAT IS PROVEN AND WHAT IS NOT, STATED SEPARATELY. PROVEN: the defect is real, its rate is 44 of 885, and its manifestation is a COMPILE FAILURE rather than a silent one -- the lost brace and the deleted RED branch happen in the same substitution, so the compiler catches the pair. Measured directly on the banked originals, 42 of the 44 place the gv_verdict call inside a conditional and 2 do not. NOT PROVEN and deliberately unquantified: whether any gate in the compiling population emits nothing on RED. The two candidates I checked by hand say no, and a crude counter is not evidence either way. THE STANDING CONCLUSION IS UNCHANGED AND IS THE REASON THIS WAS CHEAP TO FIND: the compiler refusing is the only reason 42 of these never reached the estate, so the loud half of the defect is what stopped the silent half from shipping. 2026-09-04 land SECOND REAL DEFECT REPAIRED AND SHIPPED, AND IT IS THE HALF-LANDED-EDIT CLASS CAUGHT IN THE WILD. nx_antipattern_catalog.nx was byte-identical on both trees at 36526, so it was an estate defect and not laptop rot, and it could not compile at all -- meaning a 162-pattern registry plus a mechanical scanner with its own liar-kill controls has been contributing nothing to any green. DIAGNOSIS BY INDENTATION VERSUS COMPUTED BRACE DEPTH, which located it in one pass: divergence begins at line 459 where the author's indentation says depth 1 and the braces say 2. The cause sits at line 458, a comment TRUNCATED MID-WORD reading `SUBMITGATE mode:` followed by a bare backtick and a partial identifier, and the closing brace of the `if argc >= 3` block opened at line 319 was lost together with it. That is precisely the atomicity failure this estate already has a law for -- a multi-part edit over a flaky transport where one part lands and the next does not, leaving an unclosed brace in a live source. REPAIR WAS THE BRACE ONLY. The SUBMITGATE mode was never written and I did not invent it: writing code to a spec I do not have is fabrication, not repair, and the four argv modes above plus the no-arg self-test are untouched. PROVEN BY RUNNING, not by compiling: NX-ANTIPATTERN-CATALOG GREEN with its own controls firing -- dirty control tripped at 11 hits, ghost file scored 0, mmap-in-loop positive control 1 and negative control 0. Shipped to the NAS under compare-and-swap at 37103 bytes from 36526. THE REMAINING FIVE ARE A DELIBERATE QUEUE, NOT AN OVERSIGHT, AND EACH IS TRUNCATED MID-TOKEN WITH ZERO IMPORTERS: abr_t2.nx degenerates into a repeating std_pdec triple and stops mid-identifier on `std`; nx_fbo_s2.nx stops at `let fib1:`; nx_frp_t1.nx references fib3 through fib9 which are never defined and stops at `return`; nx_delivery_report.nx stops at `last_`; and nx_flg_t2.nx is not NishiLang at all -- it is Go or C syntax, `for i := 0; i < len(str); i++` with ` 2026-09-04 retract I WROTE THE LAW THIS MORNING AND THEN BROKE IT MYSELF WITHIN THE HOUR, AND ONLY A SIZE CHECK STOPPED ME SHIPPING ROT INTO THE ESTATE. My own retraction row said, in these words, that 51 rows presented as a fix-list would send the next seat editing sources that are ALREADY CORRECT ON THE NAS and would ship laptop rot INTO the estate under the banner of fixing it. I then took the 6 OTHER-broken rows from my 841-gate compile sweep, diagnosed iv_list as called with 3 arguments where it takes 4, fixed all 5 call sites across nx_estate.nx and nx_pantry.nx, watched all 4 blocked gates go from BROKEN to COMPILES, and was one command from writing it to the NAS. The only thing that caught it was reading the NAS size first: 10226 bytes there against 8032 in my hand. THE NAS COPIES ALREADY PASSED IV_IDCAP AT ALL FIVE SITES. Had I shipped, I would have overwritten 2194 bytes of correct estate work with a stale-derived file, and the compare-and-swap guard would NOT have saved me because I would have supplied the matching expect value myself. ★★★★★★A COMPARE-AND-SWAP TOKEN PROVES NOBODY ELSE CHANGED THE FILE; IT PROVES NOTHING ABOUT WHETHER YOUR OWN CONTENT IS DERIVED FROM THE CURRENT ONE. THE FULL RE-DERIVATION, EVERY ROW PULLED FRESH BEFORE JUDGEMENT: all 7 broken rows in that sweep are laptop-tree artifacts and ZERO are estate defects. Four are the iv_list arity, already correct on the NAS. One is nx_lib_research_alias_gate reporting two definitions of nx_lib_ingest_buf, and on the NAS there is no duplicate at all -- nx_lib_ingest.nx is a COMPLETELY DIFFERENT ORGAN there, a local-file ingest into the research library, because a dedupe on 07-21 already resolved this and nx_lib_http.nx carries a comment saying so. My laptop simply held the stale pre-dedupe copy. One is nx_meta_refresh_gate, which the inbound door answers CG-IO cannot open source on BOTH trees: it does not exist in the estate at all. One is nx_vcodec_dct2_rd_gate, likewise absent. ⚠AND I NEARLY MISJUDGED THE LAST ONE THE SAME WAY TWICE: I renamed a colliding local streq, re-pulled to check, got COMPILES CLEAN and almost called the collision laptop rot -- but the pull had FAILED and I had redirected its output to /dev/null, so I was compiling MY OWN PATCHED FILE and reading it as evidence about the estate. NEVER SUPPRESS THE ERROR CHANNEL ON A CALL WHOSE SILENCE YOU INTEND TO INTERPRET, a law already in this file, broken by me here. WHAT THIS CHANGES: three items I published as owed estate work -- the iv_list arity blocking 4 gates, and two duplicate-definition defects -- DO NOT EXIST. Of 841 dry_apply-migrated gates measured on the laptop, the number broken in the estate is ZERO. WHAT STANDS UNCHANGED, because it was derived the right way: the 7 STILL-ERR rows from the attribution were each tested AFTER a fresh NAS pull, so they are real; 2 are fixed and shipped and 5 remain. ★★★★★★THE DISCIPLINE THAT WORKED IS NOT A RULE, IT IS AN ORDERING: PULL FIRST, THEN DIAGNOSE. Every finding I derived from a laptop file before pulling was wrong, and every finding I derived after pulling was right, with no exceptions in either direction across eleven files today. 2026-09-04 lesson THE FIVE I QUEUED FOR RETIREMENT MUST NOT BE RETIRED, AND FINDING OUT WHY CHANGED WHAT THE WHOLE UNCLOSED-BRACE CENSUS MEANS. I had them as abandoned generation artifacts with zero importers and proposed reversible retirement. nx_absent over buildroot/runtime, coverage_complete=1 corpus_complete=1, refuted that for one of them immediately: abr_t2 is referenced at nx_forge_rag_ab.nx:117 as ab_leg("rag:T2", "abr_t2", ...) -- a LIVE A/B leg. ⚠MY EARLIER ZERO-IMPORTERS CLAIM CAME FROM A LAPTOP GREP FOR THE QUOTED "abr_t2.nx" AND abr_t2.elf, WHILE THE REAL REFERENCE IS A BARE NAME STRING. A PATTERN KEYED TO THE WRONG VOCABULARY RETURNS A CONFIDENT FALSE ABANDONED, and abandoned is the verdict that authorises deletion. Following the reference settled the class outright: nx_forge_engine.nx:93 does fg_mkpath("runtime/", organ, ".nx", srcpath), so fe_run GENERATES the source at runtime/<organ>.nx, compiles it, and the harness classifies 1=GREEN 2=COMPILE 3=RUN 4=OUTPUT. ★★★★★★THESE ARE NOT ESTATE DEFECTS, THEY ARE BENCHMARK RESULTS, AND THEIR BROKENNESS IS THE MEASUREMENT. abr_t2 failing to compile IS the recorded T2 RAG-arm outcome; deleting it would have destroyed forge data and taken away a subject the next run overwrites. Six generated organs live in runtime/ from that one harness -- abb_t1 abb_t2 abb_t3 abr_t1 abr_t2 abr_t3 -- five compile and abr_t2 does not. Three more match the same shape and are orphaned, no harness naming them: nx_fbo_s2, nx_frp_t1 and nx_flg_t2, the last written in Go/C syntax that could never have compiled in any state, which is precisely what a failed LLM generation looks like. THE ARCHITECTURAL DEFECT, FILED: A GENERATION HARNESS WRITES ITS LLM OUTPUT INTO THE PRODUCTION ORGAN NAMESPACE, SO NO CENSUS CAN TELL AN AUTHORED ORGAN FROM A GENERATED CANDIDATE. The consequence is not tidiness -- it is that the estate's largest compile-refusal class is partly forge output, the headline overstates estate breakage, and the worklist sends the next seat to invent endings for truncated LLM text and commit it to runtime/ as repair. Remedy is a namespace split, generating into knowledge/forge/out/ or similar so every census can partition; until then NO estate compile-refusal figure should be quoted without saying whether forge output was excluded. ⛔I DELIBERATELY DID NOT MOVE THE FILES OR REPOINT THE GENERATOR: that relocates six live benchmark subjects and is the harness owner's call, and absence from buildroot/knowledge is UNPROVEN -- nx_absent returned corpus_complete=0 truncated=1 over that tree, so I cannot claim nothing else references them by path. ★★★★★★AN ABSENCE PROOF THAT DECLARES ITS OWN INCOMPLETENESS IS THE ONLY REASON THIS ENDED IN A FILING RATHER THAN A DELETION. 2026-09-04 land THE BUS STOP: THE DIVERGENCE GAUGE WAS NEVER DARK, IT WAS LIT AND UNREAD, SO THE FIX WAS TO MOVE ITS VERDICT ONTO THE SURFACE NOBODY CAN SKIP. Before building anything I ran the prescribed pre-flight, and it paid for itself immediately: nx_capsearch over 7348 entries with corpus_complete=1 returned nx_treediff at rank 1, scoring 520648, described in its own words as making laptop-SSOT versus NAS-buildroot drift A REPORT NOT ARCHAEOLOGY, with nx_treediverge_beat beside it as the standing daily gauge and nx_hashdiverge as the content-exact comparer. ★★★★★★I WAS ONE COMMAND FROM BUILDING A FOURTH COPY OF AN INSTRUMENT THE ESTATE ALREADY HAD THREE OF -- I DIDN'T KNOW IT EXISTED IS A RETRIEVAL FAILURE, NOT A DISCOVERY. Then the measurement that reframed the whole session: the beat is ALIVE, firing every roughly fifty minutes, and its latest line published divergent=3387, partition RECONCILES, verdict BIDIRECTIONAL -- NEITHER TREE IS A SUPERSET, a one-way sync in either direction DESTROYS WORK, merge per-file never push wholesale. That is precisely the fact whose absence cost me eleven hand-diagnosed files and a near-miss overwrite of 2194 bytes of correct estate work. THE GAUGE WAS FRESH, CORRECT, AND NOBODY READ IT. A second standing alarm rides the same line and is equally unread: SRCGUARD rc=4 WORK LOST, nine top-level symbols GONE from canonical sources across nx_schema_backfill, nx_softbind and nx_treehash, with the verdict DO NOT DEPLOY FROM THIS TREE, unchanged across every run in the window. WHERE THE GAP ACTUALLY WAS, measured not guessed: pulse.txt is emitted verbatim as the SessionStart additionalContext, so its first line is the first estate fact any seat sees -- and it had not been rewritten since 2026-08-06, TWENTY-NINE DAYS, while still advertising health_index=500 permil as though current. ★★★★★★A STALE HEADER IS WORSE THAN AN ABSENT ONE: AN ABSENT LINE PROMPTS A QUESTION, A MONTH-OLD LINE PRESENTED WITHOUT ITS AGE IS SIMPLY BELIEVED. SHIPPED: nx_pulse_emit, a laptop-local organ that reads the trend line from a LOCAL file (SessionStart must work offline; a guard that needs the backend is absent exactly when a saturated backend is making you impatient), judges it, and REPLACES the stale header while preserving every remaining byte. It replaces rather than prepends because the channel delivers about 2000 bytes and the file already measured 1977 -- prepending would have silently evicted the LIVE LAWS at the tail, the same cliff MEMORY.md pays for. BITE-PROVEN IN BOTH REFUSAL DIRECTIONS, not merely observed passing: over-cap REFUSES at exit 1 with the fixture byte-identical at 2378 afterwards, and an unreadable trend line ABSTAINS at exit 3 leaving the header standing rather than acquitting. ⚠MY FIRST OVER-CAP FIXTURE WAS VACUOUS -- a tr -dc pipeline yielded 460 bytes instead of 1900 so the condition was never reached and the organ correctly WROTE; I caught it only because I asserted the fixture size before believing the outcome. WIRED, because a refresh mechanism that itself goes stale IS the defect it was built to fix: roster row pulse at 3600s in stoproster.json, ten entries, all nine priors preserved, driven by a wire-only pulserefresh.ps1 that fetches and decides nothing. Proven end to end through the roster path, idempotent at 1986 bytes twice, tail byte-identical to the banked original. ⚠TWO LANDMINES HIT AND FIXED IN THE WIRING: the Git Bash chmod reported the installed elf as -rw-r--r-- while WSL, which is what actually execs it, reported -rwxrwxrwx -- MODE IS A VIEW, EXECUTION IS THE PROOF, so I proved it by running the binary; and PowerShell's Set-Content -Encoding utf8 wrote a BOM into the trend-line data file, harmless to a key-anchored search but a latent trap for any positional reader, replaced with a no-BOM writer and re-verified. 2026-09-04 retract THE SECOND STANDING ALARM IS A FALSE POSITIVE, AND I AMPLIFIED IT TO EVERY SEAT BEFORE I MEASURED IT. An hour ago I put srcguard's own words -- WORK LOST, DO NOT deploy from this tree -- onto pulse.txt, the SessionStart line every seat reads FIRST, on the strength of it being fresh and unread. Then I pulled all three flagged files from the NAS and read them, and ALL NINE reported-lost symbols are DELIBERATE, DOCUMENTED REMOVALS whose justification sits within a few lines of where the symbol used to be. nx_schema_backfill.nx:53 says in plain words that SB_SRCCAP and the private sb_has scanner "were DELETED 2026-08-25, not merely bypassed". nx_treehash.nx:285 carries th_ends_nx only in prose describing the walker's scope. nx_softbind.nx:30 and 63 and 125-128 remove the six SB__CHEST constants because "CHEST IS NOT A ROW HERE. It is derived from the oracle bands below", calling the old table "exactly the duplicate-ruler defect this file already retired once", with an arithmetic-equivalence claim beside it. TRUE POSITIVES ON THE LIVE POPULATION: ZERO OF NINE. ⚠MY FIRST CHECK WAS ALSO THE WRONG ONE AND NEARLY GAVE ME A FALSE REFUTATION IN THE OTHER DIRECTION: I grepped for the symbol names and read three as PRESENT, but a grep counts MENTIONS while srcguard tracks DEFINITIONS -- all three "present" hits were comments. srcguard is RIGHT that the symbols are gone and WRONG about what that means, and only reading the lines separates those two. THE HISTORY IS THE FINDING. Debt 1785445449 records that srcguard v1 ruled on BYTES, fired wrong both times on its first day, and was corrected because -- its own author's words -- "a shrink is not a revert; dead code deletion, comment tightening and dedup all shrink a file while the tree gets better, and A GUARD THAT CALLS THAT DESTRUCTION TRAINS EVERYONE TO IGNORE IT." v2 moved to symbol-set containment. ★★★★★★THAT SENTENCE NOW DESCRIBES v2 WORD FOR WORD: A DELIBERATE REMOVAL IS NOT A REVERT EITHER, AND THE FIX FOR A FALSE-POSITIVE RULER REPRODUCED THE SAME DEFECT ONE LEVEL DOWN. With 1785521381, which found the same detector structurally blind to intra-function corruption because the 0x0E event changed zero top-level symbols, this instrument has now been measured wrong in THREE INDEPENDENT DIRECTIONS ACROSS THREE FILINGS -- a recurrence rate, not three mistakes. Filed as a supersede. ⚠AND THE PROPAGATION LESSON IS THE ONE I PAID FOR: RELAYING A DETECTOR'S VERDICT VERBATIM INHERITS ITS FALSE POSITIVES AND CARRIES THEM TO ITS WIDEST AUDIENCE. The boot line now reads srcguard=ADVISORY (cannot tell refactor from revert) instead of an unqualified deploy prohibition, because a permanently-red alarm on the estate's most-read surface would have taught every seat to skip the whole line -- including the divergence figure beside it, which is TRUE and is the reason the line exists. ⛔WHAT I DID NOT DO, DELIBERATELY: I did not ship a fourth ruler. The obvious mechanical discriminator -- does the removed symbol's exact name still appear in the file's prose -- separates only 3 of the 9, because nx_softbind explains its six removals conceptually without naming them, so it is a NOISE REDUCER AND NOT A SOLUTION and shipping it as one would be the fourth wrong ruler in this detector's history. The discriminator that worked was reading the source. Saying that plainly is better than automating a guess. 2026-09-04 measure THE ESTATE COMPILE-REFUSAL COUNT IS ANSWERED WITHOUT THE ARRAY, AND THE HARDWARE BLOCKER WAS REAL FOR THE METHOD I CHOSE AND NOT FOR THE QUESTION I ASKED. I had recorded this as owed until the RAID recovers, because a whole-corpus NAS compile sweep would route hours of I/O around the very governor protecting degraded disks. That is true of a SWEEP. It is not true of the QUESTION. The estate already publishes knowledge/status/treecanon_nas_hash.mf, 19442 sha256 rows, so joining the laptop census against it answers per-file identity at ZERO array cost -- one 1.8 MB fetch instead of 19442 compiles. ★★★★★★A BLOCKER ATTACHES TO A METHOD, NOT TO A QUESTION -- ASK WHAT ELSE ALREADY MEASURES THE THING BEFORE ACCEPTING THAT IT CANNOT BE MEASURED. FOUR CORRECTIONS BEFORE THE NUMBER WAS HONEST, each caught by a control rather than by care. (1) The first join returned 400 of 400 NAS-ABSENT, the uniform-failure tell again: the manifest is rooted AT runtime/, so every census path needed that prefix stripped. Proven by abr_t2.nx, whose manifest sha equals the sha the content-get lane returned on pull. (2) The join then measured MY OWN REPAIRS -- the census errors were recorded before I pulled 51 NAS copies over their laptop twins, so IDENTICAL meant identical NOW. Same self-re-baselining as the migsweep, second time in one session. (3) ★★★★★★THE DEEPEST ONE: IDENTITY OF THE ERRORING FILE IS NOT IDENTITY OF ITS CLOSURE. nx_persona_gate.nx is byte-identical to the estate and STILL failed here, because nx_persona.nx, which it IMPORTS, was stale on the laptop. Requiring the whole transitive closure to be identical -- resolving imports the way the builder does, _hdl_build/ first then runtime/ -- took the claim from 284 to 139. A leaf-identity proof cannot carry a closure-level claim. (4) The contamination exclusion was then over-broad in the other direction: it listed nx_syscalls.nx, which nearly every file imports and which the pull returned SAME at 99746 bytes both sides. A PULL THAT CHANGED NOTHING CANNOT CONTAMINATE ANYTHING, so the exclusion had to be narrowed from files-I-pulled to files-I-actually-CHANGED, decided by hashing the banked pre-pull originals. FINAL, AND THE PARTITION RECONCILES AT 284: closure-proven and uncontaminated 135, closure-divergent UNPROVEN 119, excluded because the closure holds a file I changed 30. So the estate carries 135 PROVEN compile refusals from this census, with 119 more that need a pull each before anything may be said about them. THE OUTPUT IS A RANKED CAUSAL WORKLIST, NOT A COUNT, and two causes were worked to zero immediately. FIRST: nx_ts_verdict_is_valid defined in BOTH nx_token_sample.nx and nx_transformer_stack.nx -- a PREFIX collision, nx_ts_ claimed by token_sample and transformer_stack alike, three symbols colliding (NX_TS_OK, NX_TS_N_VERDICTS, nx_ts_verdict_is_valid) and NX_TS_N_VERDICTS holds DIFFERENT VALUES, 5 against 6, so merging them would have been wrong. Measured before touching: ZERO of the 17 blocked programs reference any colliding symbol -- they merely import both modules, so the collision lives in the closure and no caller needed changing. NX_TS_OK is 0 on both sides, so the one ambiguous consumer, nx_llm_run_v2.nx which imports both, is unaffected by which it binds. Renamed the transformer_stack side to NX_TXS_/nx_txs_ plus its test: 17 OF 17 UNBLOCKED BY ONE RENAME, both files shipped under CAS. SECOND: five gates each carried a private g_check beside the one nx_gate_emit_lib.nx already provides -- the duplicate-ruler defect that was ALSO a compile error, so nx_codec_provenance_gate and the four roku gates had never built at all. Deleted the local copies; all five compile, and they RUN: codec_provenance GREEN, the four roku gates RED with bytes=0 because their catalog.json fixture does not exist on this laptop, so THE RED IS UNADJUDICATED AND I AM NOT CLAIMING IT EITHER WAY until they run where the fixture lives. ⚠A REAL SECONDARY DEFECT FELL OUT OF THAT RUN: roku R9, named LIAR-KILL: no personal reference, PASSES ON A ZER 2026-09-04 lesson THE WORKLIST CONTAINED ROWS WHERE FIXING THEM IS THE DEFECT, AND THAT IS THE MOST DANGEROUS THING A COMPILE-REFUSAL LIST CAN CARRY. Working down the ranked causes I reached expand_imports failed at n=12 and read the files instead of the counts. Two of them say what they are in their own headers. nx_hdlimp_neg_probe.nx: "NEGATIVE control for the resolver fix -- imports a module that exists NOWHERE in the tree. MUST fail expand_imports before AND after the fix; IF THIS EVER BUILDS, THE RESOLVER HAS GONE FAIL-OPEN AND THE FIX IS REFUTED." nx_badimport_probe.nx: "FAIL-OPEN PROBE -- an UNRESOLVED import must be a LOUD ERROR", filed because nx_cc once emitted an EMPTY elf on an unresolved import and three real organs "built successfully" and produced nothing. ★★★★★★A PROGRAM WHOSE PURPOSE IS TO FAIL TO COMPILE IS A PASSING TEST, NOT A DEFECT -- AND A SEAT WHO TOOK MY WORKLIST AND MADE IT BUILD WOULD HAVE DELETED THE CONTROL THAT PROVES THE RESOLVER IS NOT FAIL-OPEN. Same family as the forge outputs found earlier today: in both cases a refusal IS the recorded measurement, and the census cannot see the difference. SEPARATED BY THE FIXTURES' OWN VOCABULARY, never by a name pattern I invented -- NEGATIVE control, MUST fail, FAIL-OPEN, must be a LOUD ERROR, if this ever builds: 7 of 135 are deliberate negative fixtures, 128 remain as candidate defects, and the partition reconciles at 135. ⚠THE 7 IS A FLOOR AND I AM LABELLING IT ONE. z.nx imports "z", and _nxiq_conflict.nx double-imports the same module under two names while _nxiq_noexport and _nxiq_unkns are named for the exact compiler conditions they exercise -- all four are plainly fixtures and NONE carries a marker phrase, so a vocabulary-keyed detector cannot see them. That is the same blindness this estate already recorded: a marker list keyed on the vocabulary of the thing you are detecting cannot see instances expressed in other vocabulary, and the miss reads as "this does not exist" rather than as "my definition is too narrow". ⇒ THE STRUCTURAL REMEDY IS A DECLARATION, NOT A CLEVERER PATTERN: a fixture that must not compile should SAY SO in a machine-readable field the way organ_kind.conf and organ_gate.conf already resolve kind and gate ownership by declaration rather than by name -- the estate reached that conclusion twice before, from the classifier side and from the gate side, and this is the third arrival. Until such a field exists, EVERY compile-refusal worklist must be read by a human before a single row is actioned, and that instruction now travels with the list. ⇒ Worklist written to knowledge-adjacent banks: estate_defects_worklist.txt (128 rows, ranked by cause) and estate_negative_fixtures.txt (the 7 that must stay red). ⚠5 of the 128 are the g_check duplicates already fixed and shipped this session, so the live figure is 123 and the file predates that fix. 2026-09-04 land THE SOTA MEASUREMENT I HAD BEEN DEFERRING IS LANDED AS COMPARE DATA, AND THE REASON FOR DEFERRING IT HAD EXPIRED. I said earlier today that I would not draw a SOTA comparison through instruments I had just found wrong -- a census overstating estate breakage, a detector at a 100 percent false-positive rate, and a boot surface 29 days stale. That was right when I said it and wrong to keep saying: all three were repaired or characterised in this session, so the justification no longer held. ⚠A DEFERRAL IS ONLY HONEST WHILE ITS PRECONDITION IS STILL TRUE, AND A SEAT THAT REPAIRS THE PRECONDITION MUST GO BACK AND LIFT ITS OWN DEFERRAL RATHER THAN RE-QUOTE IT. WHAT LANDED, in the shape the standing order defines and the shape /compare/browser already ships: a MEASUREMENT AND ITERATION TOOLING section in lang.matrix, 8 rows, every one mapping a real instrument of the compiler field to either an estate organ that EXISTS or a named _ABSENT_ watch. Verified before writing, not after: nx_langcensus, nx_cc_equiv_gate, nx_gate_bite, nx_lang_h2h, nx_srclint and nx_unwired all exist with the symbols named, so the generator will re-measure each on every beat and no cell can rot into a claim. Rows cover the whole-corpus compile census against crater-class ecosystem rebuilds, self-validation against multi-stage bootstrap plus equivalence-modulo-inputs fuzzing [emi2014], mutation testing over the gate fleet, benchmark receipts with a declared control [stabilizer2013], diagnostics against the bar Elm set for errors addressed to a person [elm-errors], expect-fail declaration against rustc compiletest and GCC dg-error and Go errorcheck, and the dead-code census against Go's unused-variable error and Rust's dead_code lint. Only ref keys that ALREADY RESOLVE were cited -- an unresolvable mark turns the refs gate RED, so inventing a citation to dress a row would have broken the very referee that makes the section trustworthy. THREE BUILD CONTRACTS, EACH WITH ITS DONE-RULE PRE-DECLARED BEFORE THE ORGAN EXISTS, admitted as rungs LN47, LN48 and LN49 under a new milestone M6 with ver 4.0 so the ranker prices them: closure-identity scoping (done when the organ reproduces today's 135/119/30 partition AND a planted stale import demotes a PROVEN row -- the second clause is the anti-vacuity tooth, since a scoper that never demotes has not been shown to fire); expect-fail declaration (done when it catches at least one fixture the vocabulary scan MISSED, because reproducing the floor adds nothing); and diagnostic grading (done when a deliberately regressed diagnostic LOWERS the score, so it carries its own negative control). ★★★★★★THE ONLY EXCEED CLAIMED IS THE ONE THE FIELD STRUCTURALLY CANNOT HAVE: no mainstream toolchain scopes a refusal figure by transitive-closure identity across two trees, because they build ONE tree and have never needed to. Everything else is coded PARITY or worse, including mutation testing, where the honest reading is a stronger tool at unproven coverage rather than an exceed. Sizes verified by prediction on both appends -- matrix 87125 to 92922 which is exactly the 5797-byte section, plan 166790 to 169497 which is exactly the 2707-byte rung block -- after an earlier append in this session DOUBLE-APPLIED and was caught only because the delta matched neither one nor two times the new row. 2026-09-04 land THE EVIDENCE REFEREE WAS RED ON A FALSE POSITIVE, AND THE CAUSE WAS A ONE-BYTE FORMAT TEST. Running nx_compare_refs_gate to check my own compare-data change came back 23/24 RED. My change was clean -- cite-marks-resolve-every-one PASS, marks=3281 unresolved=0, uncited_keys=0, so the section I had just landed broke nothing -- but the gate carried a live failure I had not caused: mirror-incompleteness-ratchet-does-not-rise FAIL, incomplete=1 against a baseline of 0. ★THE GATE HANDED ME ITS OWN WORKLIST rather than a bare count, which is the whole reason it was actionable in one step: knowledge/status/refs_mirror_incomplete.txt named exactly one row, procgen key fastnoise2, mirror rf_51393572.raw, reason json-unterminated, size 6339. THE DIAGNOSIS, from the bytes and the declared url, not from the verdict: the mirror is a GitHub README.md that opens with a badge, "[![GitHub Actions CI](...)](...)", and its first two bytes are 5b 21 -- an opening bracket followed by a bang. mi_classify tested exactly ONE byte: first non-space byte is { or [ means JSON. So it read a markdown document as a JSON array, found that the array never closes, and published json-unterminated against a file that is COMPLETE. ★★★★★★A FORMAT CLASSIFIER THAT KEYS ON THE FIRST BYTE MISREADS EVERY MARKDOWN DOCUMENT OPENING WITH A LINK OR A BADGE -- AND ON GITHUB THAT IS THE NORM, NOT AN EDGE CASE, so the false-positive population is every README mirror we hold. THE FIX IS TWO BYTES WIDE AND CANNOT MISJUDGE REAL JSON: after the opening bracket the next non-space byte must be able to START a value -- quote, brace, bracket, closing bracket, minus, digit, t, f or n. A bang is none of them. No valid JSON can fail that test, so the check is wrong only in the direction of DECLINING TO JUDGE. PROVEN BOTH WAYS ON THE REAL FILE, not on a planted fixture: pre-fix the classifier returns class=1 SUSPECT rcode=5 json-unterminated, post-fix it returns class=3 UNKNOWN rcode=9 no-format-signature-cannot-judge. ★IT ABSTAINS RATHER THAN ACCUSING, AND IT DOES NOT SWING TO THE OPPOSITE LIE EITHER -- it does not claim COMPLETE, because it cannot verify markdown completeness, and an instrument that cannot see must say so rather than acquit. AND THE DETECTOR STILL BITES: nx_mirrorintegrity_gate ran 15/15 GREEN with json-unterminated BITE-PROVEN (fires on bad, silent on good), so genuinely truncated JSON is still caught -- a fix that quiets a false positive by disabling the detector would have been worse than the false positive. ⚠THIS IS THE SECOND MEASURED FALSE-POSITIVE CLASS IN THIS ONE INSTRUMENT: the first was a 941-per-thousand rate on structural completeness, root-fixed after controlling all 17 cited files of a class. A detector bite-proven on PLANTED fixtures is not calibrated on REAL data, and both times the real data was where it broke. ⚠And a self-inflicted trap for the fourth time in this session: the probe read bytes=0 unreadable because I wrote its fixture from Git Bash into a /tmp that WSL cannot see -- the same filesystem split that cost three earlier runs, repeated after I had already journalled it twice. ★I removed the probe from runtime/ when I was done: leaving scratch in the production organ namespace is exactly the defect I filed against the forge four hours ago, and writing the row does not exempt the author. 2026-09-04 land CLOSED END TO END: THE ESTATE'S EVIDENCE REFEREE IS 24/24 GREEN, AND THE SOURCE FIX WAS ONLY HALF THE WORK. Shipping nx_mirrorintegrity_lib.nx would have left the fix BUILT-AND-UNSHIPPED -- the exact class this session has been documenting all day, where a written and compiled correction is byte-indistinguishable from a bug nobody found. The gate COMPOSES the classifier in-process, so the fix reaches nothing until the gate binary itself is rebuilt. Full chain, every step verified by artifact rather than receipt: /api/build returned BUILT 90400 bytes with src_path naming buildroot/runtime/nx_compare_refs_gate.nx -- READ ON EVERY BUILD, because expect_sha256 proves the staged bytes are the ones just built and says NOTHING about whether the right source was compiled; /api/promote with expect_sha256 returned PROMOTED at that identical sha 3879f57b with prev banked; and the re-run moved the board. THE MEASURED MOVEMENT, and the partition holds at 1275 across it: truncated_suspect 1 to 0, unknown 140 to 141, incomplete 1 to 0, so mirror-incompleteness-ratchet-does-not-rise went FAIL to PASS and the gate went 23/24 RED to 24/24 GREEN. ★THE ROW MOVED SUSPECT TO UNKNOWN, NOT SUSPECT TO COMPLETE, exactly as the pre-ship probe predicted -- the classifier declines to judge a markdown body rather than swinging to the opposite lie, and unknown rising by exactly one is the receipt that the change did what it claimed and nothing else. ⚠THE GATE'S OWN RESIDUAL IS PUBLISHED IN ITS VERDICT AND I AM NOT PAPERING OVER IT: fetch-time provenance proves the mirror is OF the url, never that the mirror SUPPORTS the claim -- 587 of 1275 mirrors remain provenance-unproven, that is a declared human read, and no tooth on this gate measures it. GREEN here means the citations register is well-formed and its mirrors are whole; it does not mean the claims are true. 2026-09-06 measure THE LANG LADDER IS DELIBERATELY NOT DECLARED, AND THE REASON IS A MEMBERSHIP DISCREPANCY THAT MUST BE RESOLVED FIRST. nx_compare_rank reports rungs=82 for this board. A literal count over this file gives 82 occurrences of the string rung-pipe but only 81 whose id begins with L, and nx_txtscan matches case-insensitively so that is not a case artifact; probes for rung-pipe followed by E, C, D, T, N or F each return zero. So exactly one counted rung either has an id I cannot enumerate, or one occurrence of the string sits in PROSE inside a note and is being counted as a row. THOSE TWO POSSIBILITIES HAVE OPPOSITE REMEDIES AND I CANNOT YET TELL THEM APART, WHICH IS PRECISELY WHY NOTHING WAS DECLARED. A LADDER IS ALL-OR-NOTHING: NO-LADDER is merely LABELED and ranking proceeds, while PARTIAL makes nx_compare_rank REFUSE with exit 6. Declaring two sotatargets and 81 rungroles would therefore leave unplaced=1 and take the estate's largest language board out of ranking entirely, trading a harmless labelled state for a broken one, and if the second possibility is true the board could NEVER be completed because the missing rung does not exist to be placed. THE CHEAP EXPERIMENT THAT SETTLES IT, for whoever picks this up: enumerate the rung ids the ranker itself parses and diff that list against the 81 enumerated here (LB0-LB6, LN1-LN65 including LN13a and the LN board anchor, LR1-LR7); if the ranker's extra entry has no id, its row parser is counting a prose occurrence and that is a defect in the ranker rather than a gap in this plan. The formats board was safe to ladder in one atomic append precisely because its nine rungs were authored in this session and their membership was known exactly. 2026-09-06 land THE LANG LADDER IS DECLARED AND THE BOARD READS LADDERED: targets=2 rungs=82 placed=82 unplaced=0 badrole=0 badtarget=0 orphans=0 sum=82 with substrate 47, arm 16 and contender 19 summing exactly, alongside BARFRESH bars=5 fresh=5 malformed=0 verdict=FRESH. THE BLOCKER WAS A MEMBERSHIP QUESTION AND REFUSING TO GUESS IT IS WHAT MADE THIS SAFE. The ranker reported 82 rungs while a literal count found 82 occurrences of the row marker but only 81 whose id begins with L; probes for E, C, D, T, N, F, M, W and a leading-space prose mention all returned zero, and the per-group counts (LB 7, LR 7, LN1x 12, LN2x 11, LN3x 11, LN4x 11, LN5x 11, LN6x 7, LN7, LN8, LN9, the board anchor) summed to exactly 81, which proved the missing row was real rather than a miscount. It is rung 2026-09-26 measure 2026-09-26 THE BOARD READ BEFORE ANY ROW WAS ADDED: nx_compare_rank lang read 98 rungs (45 done, 53 open, 19 with no matrix row), target version 2.0 at M3, critical path LN13 closures (a DARK-CONTRACT: the organ exists and the symbol is undeclared), then LN70 serial elision, LN46, LN69 mode fit, LN72 effect handlers, LN76 compile-time execution; nx_barfresh lang 8 of 8 bars FRESH for 2026-09; nx_ladder lang LADDERED 98 of 98 over 5 dated targets; the scorecard receipt of 2026-09-22 stands at 396 rows, win 118, lose 131, tie 98, unmeasured 49, superior NO, with the safety ring (every mode PART because it defaults OFF) and speed (default 7105 us against C 2079, Rust 4445, Go 4163; f1 4189 beats checked Rust and loses to Go and C) the two LOSE clusters 2026-09-26 measure 2026-09-26 THE CURRENT MONTH READ, not recalled: the cs.PL listing (100 entries, 2026-08-27 to 2026-09-24, counted by the estate digester on the pinned bytes), the cs.MS and cs.SC listing (60, to 2026-09-23) and the quantum and photonic listing (60, to 2026-09-18) were fetched through nx_research_fetch, pinned, and read entry by entry; the rival versions were read from mirrored release pages (Julia 1.13.0 on 2026-09-10, Lean 4.34.1 on 2026-09-24, Mojo 1.1.0 on 2026-09-17, R 4.6.1 on 2026-06-24, MoonBit's September 2026 hackathon page); DARPA's page is a script-driven shell and its RSS feed carried this month's 10 opportunities; the Kaggle competitions page answered with a bot challenge and was REJECTED as a mirror, the kernel image Dockerfile was mirrored instead; the EU CRA page names 11 September 2026 as the reporting-obligation date 2026-09-26 lesson 2026-09-26 A SEAT DIGESTED THE LISTINGS WITH A LAPTOP SCRIPT BECAUSE THE ESTATE HAD A CENSUS BUT NO READER: nx_arxiv_census proves a window is a population and nx_search_emerge extracts the month, and nothing turned the pinned bytes into rows a person or crew organ can read, so the read happened outside the estate -- the add-on LN80 exists to count. LN96 closes it in the language (nx_arxiv_digest with a bite-proven gate); the census stays the completeness ruler and the digest never claims it 2026-09-26 queue 2026-09-26 THE CRITICAL PATH THE RANKER OWNS, NOT THIS SEAT: LN13 closures is a DARK-CONTRACT and its remedy is one edit (repoint the rung and its row to the real entry point, or name the function parse_closure_capture); the domain, door and arena rungs above rank by the ranker's own arithmetic on the next run, and the three targets are refused as LADDER-PARTIAL if any rung loses its role; the Kaggle competitions page and the Cangjie release page are still to be mirrored, and a Mathematica column waits on a mirrored version page before it is graded 2026-09-26 retract 2026-09-26 THE COUNT 97 WAS WRONG AND THE ESTATE ORGAN CAUGHT IT: the barscan row, the ref cite and the measure row first said 97 entries from 2026-08-28, a number produced by a laptop script that reassembled the mirrored listing from line windows and dropped three entries at window seams (229,729 of 233,437 bytes reassembled); the shipped digester read the pinned bytes whole and counted 100 entries from 2026-08-27; all three sites were corrected the same hour. The add-on the zero add-on ratchet exists to count was also the instrument that miscounted, which is the whole argument for LN96 2026-09-26 measure 2026-09-26 THE BOARD AFTER THIS LEG: nx_barfresh 11 bars 11 FRESH; nx_ladder 8 targets (1 best-in-class, 7 frontier) 113 rungs placed 113; nx_compare_rank 113 rungs done 47 open 66 with the critical path unchanged at LN13 closures (DARK-CONTRACT, one edit away), then LN70 serial elision, LN69 mode fit, LN72 effect handlers, LN73 mapper, LN76 compile-time execution, LN46, LN75 doors, LN77 syntax extension, with LN78 the mathematician's stack at 15 and LN92 the quantum door at 16; the scoped regen published api.json 376,706 B (prev 326,481) and index.html 1,089,453 B (prev 945,866) with forkfresh 1 of 1 and verdict GREEN; the fleet refs gate read 38/44 RED on other domains' rows (graphics and procgen pins, uncited keys in authz, deploy, dataio and civicmap) with zero lang offenders across the 28 new pinned rows 2026-09-26 queue 2026-09-26 OWED AND NAMED: the page reader nx_scorecard_receipt_lib skips the hash-prefixed cat rows and does not yet render a per-category table (LN90 follow-on: teach the ONE reader the cat row, then render); the Kaggle competitions page answered with a bot challenge and the Cangjie release page is not yet mirrored (SB-LANG-ARENAS names both); a Mathematica column waits on a mirrored version page; LN82's first suite (Charlwood's 50) is a data file to author from the mirrored paper before any domain rung claims a number; every new rung ranks by the ranker's arithmetic and none was hand-placed 2026-09-26 land 2026-09-26 wave 13 SEAT TOOLCHAIN: THE opt_reassoc SHARED-CONSTANT FOLD IS FIXED IN THE PROMOTED COMPILER (debt 1790438934). The fold now lands in a fresh ir_const_i64 carrying the operand type (nx_opt.nx sha ac4fe062, 181227 B); a --no-cache rebuild of nx_compile_x86 was byte-identical to the 08:44 candidate (6d71ae5d, 989752 B), nx_cc_equiv_gate on it read rows 10/10 selfhost PASS kat PASS GREEN (job 1790454342), and the canaried POST /api/promote_toolchain moved buildroot/_offc/nx_cc_sovereign.elf 0b10f429 to 6d71ae5d with canary GREEN and 0b10f429 banked as .prev (a stale 989568 B nx_cc_sovereign.elf.new left from an earlier promote was overwritten first, or the promote would have installed it); the serving root nx_compile_x86.elf was promoted to the same bytes and nx_filehash cmp reads identical=1, so the two roots are one file; nx_ccfold_repro built by the production builder --no-cache reads defect_wrong=0 of 2 shape_wrong=0 of 8 control_wrong=0 of 2 verdict=CLEAN exit 0 (job 1790454716), the pointer probe of the RSA site reading 202 2026-09-26 land 2026-09-26 THE COMPILER GATE NOW CARRIES THE FIXTURE AS A KNOWN-ANSWER STAGE: nx_cc_equiv_gate builds runtime/_hdl_build/nx_ccfold_repro.nx with the CHALLENGER by direct compiler exec (never the build cache, whose hit reuses an artifact without running the compiler under test), requires exit 0, prints the fixture's own probe counts on a CC-EQUIV kat line and decodes exit 1 (the compiler miscompiled a known answer) from exit 3 (a fixture control read wrong); the summary line gains kat=. Bite on the pre-fix compiler (_offc .prev ef649d20): rows 10/10 PASS, selfhost PASS, kat exit=1 defect_wrong=2 of 2 shape_wrong=7 of 8 control_wrong=0 of 2, gate RED (job 1790454494); on the fix GREEN. Shipped through nx_organ_ship against a release-flavour fixed challenger (the gate refuses a challenger byte-identical to the baseline): f405c97d promoted, _offc twin installed; the two lost runs were the base-class symbol names gv_cat and gv_catn (allow_loss_v1 ce5eb908) and the behaviour change (epoch header plus three additive report items) was reviewed (allow_behavior_v1 5793c92c) 2026-09-26 measure 2026-09-26 AFFECTED ORGANS REBUILT ON THE FIXED COMPILER (nx_sov_build_run --qualify, fresh builds, nothing promoted by the qualify runs): gates nx_procgen_scene_gate 4/4 GREEN, nx_cloud_volume_gate 16/16 GREEN, nx_clock_edf_gate 11/11 GREEN, nx_gamefeel_oracle_gate 17/17 GREEN; nx_zero_claude_ledger_gate SKIP (the staged model gguf precondition is missing on this host, 0 checks run); nx_vcodec_t8noise_gate RED on a fixture precondition (cannot read yuv from the buildroot CWD); nx_worldgen_gate stopped at the 180 s qualify deadline. The four held crypto organs were rebuilt: nx_rsa_pkcs1_sign, nx_x509_emit and nx_authenticode_sign selftests each ran out the 540 s deadline while generating the deterministic 2048-bit test modulus (end-to-end UNOBSERVED; the fixture's pointer probe of the rsa site reads 202 on the fixed compiler), and nx_efivars_enrol was rebuilt build-only, never run and never promoted (never-brick). None of the four is promoted. Superseding debt 1790457142 carries the rest (ships of the shipped sites, a keygen-free crypto KAT or a longer deadline, the census re-run which needs its listfile); 1790438934 EATEN 2026-09-26 land 2026-09-26 ROLL-OUT OF THE FIXED COMPILER INTO SHIPPED SITES, AND THE CONTROLS: nx_procgen_scene_gate re-shipped through nx_organ_ship (e87bf184, 4/4 GREEN, behaviour IDENTICAL; the three lost runs were base-class symbol names sys_openat_append, gv_cat, gv_catn, allow_loss_v1 00b754ef) and nx_cloud_volume_gate re-shipped (058e14c7, 16/16 GREEN, same three symbol names, allow_loss_v1 b94f2527); nx_compile_wat, which links nx_opt.nx, was re-shipped 6ea4c2ef so the wasm lane carries the fold fix too. NOT shipped, with the reason: nx_gamefeel_oracle_gate (the SERVED binary is RED 0/1 because it reads an absolute buildroot/knowledge/gamefeel_oracle.conf that does not exist, the current source reads it and the candidate is 17/17 GREEN, but the ship loop refuses a behaviour comparison against a live run that did not succeed); nx_clock_edf_gate (the candidate drops real clock-library strings -- SS-COMMIT REFUSED, STS-LOCK open-failed, clk_merge_store MALFORMED/REPERIOD/RETARGET -- from the clock sources' own evolution, a loss for that owner to adjudicate; its site is latent). Census re-run over the wave 10 list (job 1790457902): listed=22299 read=22297 unread=2 functions=206209 const_locals=13448 hits=49 locals_observable=35 locals_latent=8 files_with_hits=34 coverage_complete=0 (wave 10: 47 hits, 34 observable, 7 latent, 33 files; none of this wave's edited files carries a hit) -- the source shapes stay, and they are harmless once rebuilt by the fixed compiler. VM regression control: nx_wasm_popcnt_gate rebuilt on the fixed compiler and the new VM, run against the promoted nx_compile_wat, 119/119 GREEN 2026-09-26 measure 2026-09-26 nx_worldgen_gate rebuilt on the fixed compiler reads 4/4 GREEN given a 600 s deadline (job 1790457676; it had stopped at the 180 s qualify deadline earlier), so the nx_worldgen library with its GI-path site builds and passes on the fixed compiler; it and nx_gen are not re-shipped (the gate needs about eight minutes, longer than the ship loop's prove window was tested for). Wave 13 debt state for this defect: 1790438934 and the interim 1790457142 EATEN, the final state carried by 1790458186 (sev 4)

autodev Cross-domain journal anchor: autodev entries recorded on this board · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`-` · executor Board · 0 u · stands on nothing
Definition of done	DECLARED 2026-09-04 by nx_board_idref_gate. Two log rows on THIS board are addressed to the id autodev and describe work in the autodev DOMAIN, not in lang: they record nx_autofix_intake_gate going RED 3 of 5 to GREEN 5 of 5. They are also an EXACT DUPLICATE PAIR at the same epoch with identical text, which is the signature of a double-applied append rather than two findings. Declaring the anchor is additive and makes them resolvable instead of dangling; it does NOT make them correctly filed. THE OWNING LANE SHOULD RE-JOURNAL THAT FINDING ON THE AUTODEV BOARD against a real autodev rung, after which this anchor can be retired through nx_retire_path. Nothing is deleted here on purpose: history is additive and a mis-addressed record still is a record.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `-`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-03 land The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 1788405975 (sev 5) autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix 2026-09-03 land The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 5 autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix 2026-09-10 release 2026-09-10 API-first toolchain delivery: live nx_fileop prepare-install-intent creates immutable checksum-bound plans and accepts identical replay without publication; native15/15 plus guarded ship contentGREEN/behaviorIDENTICAL. Live management daemon c07bc53f exposes /api/v2/promote_toolchain with host-pinned candidate/qualification, durable outcome, target lock and rollback; canonical signed-route13/13 and live wrong-intent refusal verified. Explicit toolchain-v2 registry rows refuse legacy deploy with VERSIONED_OPERATION_REQUIRED. Health initially reported restart transition down, then overallOK; running-executable identity independently matches. Configured runner candidate b947a767 and both intents prepared, RUNNER NOT YET PROMOTED; two other distinct runner copies unchanged. Full receipt knowledge/gates/toolchain-route-live-release-20260910.json. OOM handling, cross-target cohort, automatic journal reconciliation and full-model task savings remain unqualified.

LN47 Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lc_closure_scope` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04, before the organ exists. The census resolves each program's transitive imports the way the builder does (_hdl_build/ first, then runtime/) and stamps every ERR row PROVEN or UNPROVEN by whether EVERY file in the closure is byte-identical to the estate manifest, not merely the erroring file. Done when: the organ reproduces the hand-computed partition of 2026-09-04 (135 proven, 119 unproven, 30 excluded, summing to 284) from the same two inputs, AND a planted stale import under a byte-identical leaf moves that row from PROVEN to UNPROVEN. The second half is the anti-vacuity tooth: a scoper that never demotes a row has not been shown to fire.
Matrix cell	Closure-identity scope on any cross-tree claim -- a leaf-identity proof cannot carry a closure-level claim · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 measure THE COMPARE BOARD'S OWN PUBLISHER WAS STALE FOR OVER THREE HOURS, AND ADJUDICATING THE RESTAGE IS THE SAME DISCRIMINATION PROBLEM THIS RUNG EXISTS FOR. compare_forkfresh.status read ts=1788536768, more than 3.3 hours old, with FORK-STALE nx_swcompare_matrix -- the generator whose CWD fix I had deployed as SOURCE earlier today without rebuilding its buildroot/_offc twin, so every matrix page including the measurement section I had just landed would have published through the old binary. That is the third-twin defect CLAUDE.md records as having cost four seats the same investigation, recurring in my own lane the same day I read it. nx_restage through nx_job_run returned RESTAGED 328449 bytes. THEN THE QUESTION: the promoted binary is 357136 bytes, sha a76b4271, and the fresh fork is 328449, sha d460aa13 -- 28687 bytes SMALLER after an addition, which the standing law reads as a REVERT. A SIZE DELTA IS A QUESTION, NOT A VERDICT, so the content ruler decided it, and its answer was honest about its own limits: lost_from_live=268 partitioned srcpath=19 symbolname=245 sectname=3 other=1, summing to 268; symmetry=BIDIRECTIONAL with 13 runs GAINED; and its own text naming the cause -- most of the loss is compiler-embedded source paths and symbol names, which is what -g adds, a debug and a release build of the same source differing by about 184 permil -- against a measured 180 permil here. The single lost_other, the string RED (a check failed), reappears in the GAINED list with a colon appended: RE-ENCODED, not lost. And the GAINED list carries my own CWD-fix refusal text, .matrix absent from BOTH, plus REGISTRY-MISPOINTED and neg-control-nonzero -- new capability, present in the fork and absent from the promoted binary. ★★★★★★THE FORK IS AHEAD OF THE PROMOTED BINARY AND IN RELEASE FLAVOUR; THE RED IS A FLAVOUR ARTIFACT THE RULER ITSELF PREDICTS, AND THE PROMOTED BINARY IS THE STALE ONE. The regen was launched through it. ⚠WHAT IS OWED AND WHY IT IS THIS RUNG'S BUSINESS: leaf-versus-closure identity and debug-versus-release flavour are the same failure -- a byte comparison whose SUBJECT is wider or narrower than the thing it claims to judge. The ruler's own prescribed control, rebuild the candidate with --debug and re-run, which took nx_hostctl from 332 lost to 2, was NOT run here because the array is degraded and the partition plus the bidirectional symmetry plus the re-encoded lost_other decided it; that control is the definitive one and stays owed. And the promoted binary should be re-promoted from current source so promoted equals fork equals source -- three roots means three checks, and today two of the three disagreed. 2026-09-04 land THE COMPARE GENERATOR'S THREE ROOTS AGREE, AND THE LANE-VARIANCE CLASS IS NOW CLOSED THE WAY THE RECORD SAYS TO CLOSE IT. Sequence, each step verified by artifact: /api/build from current source returned BUILT 363888 bytes sha 2b7f4e0c with src_path naming nx_swcompare_matrix.nx and a banked prior stage from another seat; the same-lane content ruler read lost_from_live=2 at 1 permil -- cl_regorgan, a dead symbol name, and RED (a check failed), which reappears in GAINED with its failing conjunct now appended, a re-encoding that is an improvement -- with 27 runs gained including my own CWD-fix refusal text; /api/promote at that sha returned PROMOTED with prev banked. THEN THE STRUCTURAL FACT: a second nx_restage rebuilt the buildroot/_offc fork at 328449 bytes, the same size as the first, because the restage lane and the api/build lane produce different bytes from IDENTICAL source, 9.7 percent apart and inside the measured 6 to 17 percent band. A rebuilt fork can therefore NEVER read FRESH against a promote from the other lane, by construction, and the regen's freshness check was reading that permanent mismatch as staleness. ★★★★★★WHEN TWO LANES CANNOT PRODUCE THE SAME BYTES, FRESHNESS MUST BE ESTABLISHED BY COPY, NOT BY REBUILD -- and the record already said so: nx_filecopy promoted into buildroot/_offc with overwrite, mode preserved. NX-FILECOPY OK bytes=363888 verified=1, destination re-read and compared byte-for-byte, mode_preserved=493. Promoted, fork and source now agree, and the next regen's forkfresh line is the receipt that will show it. The debug-flavour control the ruler prescribes was made unnecessary for this target by the copy, but it stays owed as the general instrument for any target that must be rebuilt rather than copied. 2026-09-04 land THE EVIDENCE REFEREE HAD A FIXED READ WINDOW ON ITS OWN PROVENANCE JOURNAL, MY ADMISSIONS CROSSED IT, AND THE GATE ABSTAINED HONESTLY INSTEAD OF ACQUITTING -- WHICH IS THE ONLY REASON THE DEFECT WAS FOUND THE SAME HOUR. Third refs-gate run of the day read 22/24 RED with every substantive tooth passing -- pins matched 1351 of 1351, unresolved 0, uncited 0, incomplete 0 -- and its first line naming its own blindness: PROV-JOURNAL-TRUNCATED, the journal filled this reader's window, so the provenance verdict is UNOBSERVABLE. The two failing teeth were the truncation abstain and the unproven ratchet RISING by 29 -- and all 29 named rows were mine, the LLM and browser mirrors admitted minutes earlier, each of which the fetch lane HAD journalled: they were in the file, past the window, and a reader that cannot see a row cannot count it proven. CAUSE, from the source: CRG_CAP = 262144, ONE constant shared by NINE unrelated reads in the gate, and the journal reached 1306 rows. ★★★★★★A CAP IS NOT A NUMBER TO TUNE, AND ONE CONSTANT SERVING NINE PURPOSES CAN NEVER BE TUNED FOR ANY OF THEM. Fixed the way the record prescribes: the journal read composes sys_read_file, which sizes its buffer from the file and cannot short-read, so the TRUNCATED state is retired by construction and the observed-not-absent-not-truncated tooth keeps only its honest half -- an absent journal still fails it, because sys_read_file returns null on absent and prows stays 0. No other read in the file was touched: the eight siblings each get their own decision, not a widened constant. Shipped under compare-and-swap at 49123 bytes from 47565, built at 92080 bytes sha 6fb249b1 with src_path verified, promoted at that sha with prev banked, and RE-RUN: 24/24 GREEN, jrnl_rows 1306 to 1335 -- exactly the 29 rows the old window hid -- proven 738 to 767, unproven 616 back to the baseline 587 to the row, the truncation line gone. ★THE MOVEMENT IS THE PROOF: a reader that gained precisely the rows it was previously blind to, and a ratchet that fell by precisely that count, is a fix whose effect was predicted before it ran. ⚠THE OTHER EIGHT CRG_CAP READS ARE NOW A NAMED WORKLIST, NOT A FIXED PROBLEM: each register, matrix, plan and sota read in this gate still wears the same constant, and any of them crosses 256 KB the day a board grows enough -- browser.matrix is already 107 rows. Each should compose sys_read_file on its own merits; I fixed the one that was measured broken and named the rest rather than sweeping them blind.

LN48 A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lc_expect_fail` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Every mainstream toolchain declares negative tests in the fixture -- rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck -- and the estate has no equivalent, so its compile-refusal worklist contains rows where fixing them destroys the control. Done when: a declaration field exists and the census partitions expect-fail from defect MECHANICALLY, the 7 fixtures found on 2026-09-04 by their own prose are all declared, AND at least one fixture that carries no marker phrase (z.nx and the _nxiq_ family are the known cases) is caught by the declaration and would have been missed by the vocabulary scan. That last clause exists because the 7 is a FLOOR and a mechanism that only reproduces the floor has added nothing.
Matrix cell	Declared expect-fail fixtures -- a program whose purpose is to refuse must say so · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD5 The verdict line is LAST and judged by position, never by text adopted LD7 Every organ ships with a gate that bites a planted known-bad adopted
Work log	no log row names this rung yet

LN49 Compiler diagnostics are GRADED against a known-bad fixture set, not asserted · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cc_diag_grade` · executor Organ · 3 u · stands on LN46
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. The shipping compiler already emits the three-part shape Elm set the bar for -- a caret line, a why-the-build-stopped clause and a fix clause -- and names the enclosing construct, but NONE of that is measured, so the quality claim on this board is an assertion. Done when: a fixture set of known-bad programs with expected span and expected suggestion is scored for span accuracy and suggestion correctness, the score is PUBLISHED on this page rather than claimed, and a deliberately regressed diagnostic (a refusal stripped of its caret) lowers the score. Carries its own negative control by construction.
Matrix cell	Diagnostics graded against the field's benchmark for human-readable errors · `runtime/nx_cc_sovereign.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_cc_sovereign`; declare `nx_cc_sovereign TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN50 One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nx_diag_object` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. The same object renders through all three emitters [gcc16] [rustc-annotate]; a planted nested child must appear in all three; the machine sink validates against the pinned schema (LN56).
Matrix cell	Diagnostic object model rendered by three emitters · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD4 Refuse first and name the rule: every refusal carries the rule that fired adopted
Work log	2026-09-04 land September 2026 compiler and toolchain SOTA admitted as DATA from the adversarially verified sweep (workflow wf_d98197e2-d2e): 20 refs pinned by fetch receipt (lang.refs 18143 to 27986 B), a section of 15 rows with 13 watch contracts and 2 met-bar rows (lang.matrix 92922 to 101456 B), rungs LN50-LN59 under M7 ver 5.0 (lang.plan 187305 to 191267 B); every append settled by predicted size and proven single by row-unique count on the tail 2026-09-04 measure referee nx_compare_refs_gate 24/24 GREEN fleet-wide (job 1788561456): files=103 rows=1454 pins=1390 matched=1390 marks=3530 uncited=0 unresolved=0 provenance proven=806 mismatch=0 unproven=587 unchanged. Sweep attrition: 24 findings, CONFIRMED 17, ALREADY-COMMON 3 (schema validation, Fedora mass rebuild, lit expect-fail vocabulary), REFUTED 2 (ClozeMaster bug count, Alive2 daily dashboard), UNDATED 1 (SARIF 2.2), UNCITABLE 1 (diverse double-compiling in practice); only CONFIRMED items carry watches, the others are bars

LN51 A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lc_diag_snapshot` · executor Organ · 2 u · stands on LN50
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Snapshot per refusal over the whole census, count printed [rustc-annotate]; a renderer that drops a nested child must show at least one differing snapshot; an identical renderer must show zero.
Matrix cell	Renderer snapshot corpus over the refusal census · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN52 A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lc_known_bug_id` · executor Organ · 1 u · stands on LN48
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Parse refusal without an id [rustc-directives] [llvm231]; fixing the planted bug must turn the row RED; rows per class printed so zero of zero cannot read green. Extends LN48.
Matrix cell	Known-bug rows require an issue id and go RED on unexpected pass · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD5 The verdict line is LAST and judged by position, never by text adopted
Work log	2026-09-04 queue build order from the cross-domain rank, cheapest proof first: LN52 known-bug id and XPASS (SMALL, on nx_langcensus beside LN48), LN56 schema-validated diagnostics with SKIP, LN55 two-axis peephole harness, then LN50 and LN51 together (object model then snapshot corpus), LN53 rebuild partition, LN54 per-pass certificates (MEDIUM, the credible-compilation rung the field measures at a tenth of full verification), LN57-LN59 behind their named prerequisites; the masked vectoriser and the seed SBOM chain are LARGE watches, third tier

LN53 After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lc_rebuild_partition` · executor Organ · 3 u · stands on LN47
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Partition regressed, fixed, spurious-regressed, spurious-fixed, unchanged sums to the population [crater159343] [fedora45]; a planted admission refusal lands in spurious with its reason; a retry lane re-runs only changed rows.
Matrix cell	Whole-ecosystem rebuild census with a named-reason spurious partition · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN54 Three optimisation passes emit certificates an independent checker accepts over the whole census · cell WATCHING · gate NO-GATE-DECLARED

Contract	`opt_pass_certificate` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Unreachable-code, dead-assignment and constant-fold certificates checked by code shared with no pass, count printed, self-host rebuild still byte-identical [rinard10x] [compcert318] [brack]; a mutant that folds one constant wrongly is refused naming pass and site.
Matrix cell	Certified compilation as the oracle; per-pass certificates as the unit · `runtime/nx_opt.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_opt`; declare `nx_opt TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 retract the first referee run read 23/24 RED on provenance-mirror-url-never-contradicted: the brack row carried a hand-typed URL (Verified-Scheme-Compiler) while the fetch journal holds the URL the mirror was actually taken from (Verified-Compiler-for-Scheme). Corrected in place by one whole-file CAS write; re-run 24/24. The claim was never wrong, the address was 2026-09-04 lesson the fetch RECEIPT is the row: it carries the saved path, the sha256 and the URL that was fetched, so a ref row is composed FROM the receipt, never from a URL typed by hand or matched by prefix. The provenance tooth exists for exactly this and it fired on the first try; a receipt-composed row cannot contradict its own journal

LN55 A missed-peephole candidate is scored sound and profitable on two printed axes · cell WATCHING · gate NO-GATE-DECLARED

Contract	`opt_peephole_bench` · executor Organ · 1 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Sound by the equivalence probe, profitable by instruction count [peepholebench]; an unsound profitable rewrite reports REJECTED, never one of two.
Matrix cell	Missed-peephole two-axis harness · `runtime/nx_opt.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_opt`; declare `nx_opt TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN56 Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cc_diag_schema` · executor Organ · 1 u · stands on LN50
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Schema mirrored and pinned [sarif-tc] [gcc-sarif-schema]; a planted malformed diagnostic is refused by field name; removing the validator yields SKIP, never GREEN.
Matrix cell	Machine-readable diagnostics validate against a pinned schema · `runtime/nx_cc_sovereign.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_cc_sovereign`; declare `nx_cc_sovereign TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN57 The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator · cell WATCHING · gate NO-GATE-DECLARED

Contract	`x86_regalloc_backtrack` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Behavioural equality over a printed count of generated functions [regalloc3]; a planted mis-assignment is caught by the fuzz lane; depends on the allocator watch x86_use_regalloc.
Matrix cell	Backtracking register allocator fuzzed with generated functions · `runtime/nx_x86_64_ctx.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_x86_64_ctx`; declare `nx_x86_64_ctx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN58 Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses · cell WATCHING · gate NO-GATE-DECLARED

Contract	`eqsat_bounded_acyclic` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Bound in a conf row [egraphs2026]; the stochastic control and the bounded run agree on the census subset, counts printed; a bound of zero must be refused as vacuous.
Matrix cell	Bounded acyclic e-graph with a stochastic-search control · `runtime/nx_eqsat.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_eqsat`; declare `nx_eqsat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN59 Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sp_mutator_from_bug` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Each mutator names the defect row it came from [issuemut]; a replayed mutator must reproduce its origin defect on the pre-fix binary and pass on the fixed one; prerequisite: defect rows carry their triggering input.
Matrix cell	Mutators mined from the compiler own bug history · `runtime/nx_shapeprobe.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_shapeprobe`; declare `nx_shapeprobe TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN60 Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`count_global_tokens` · executor Organ · 3 u · stands on LN49
Definition of done	DONE-RULE PRE-DECLARED 2026-09-05 (operator, same day: numbers need evidence on why they are set or need to be dynamic, no guessing; this belongs to the NishiLang shape and theory with research and reasoning as of September 2026). MEASURED CAUSE: parse_module derived its FUNCTION pool from counted func tokens after a 256-slot pool corrupted nxc.nx twice (T#selfhost-004/006), but kept a DECLARED 4096 for the GLOBALS pool behind a comment claiming it could not be derived -- and on 2026-09-05 the nx_wgsl unit (shader front-end + both backends + the world and cast shaders) reached 4097 and the build stopped at the guard. It CAN be derived: every global is anchored to a TK_STRING, TK_STATIC, TK_FLOAT/TK_FLOAT_F32 or TK_FUNC token, so the bound is that sum plus a NAMED slack for backend-synthesised entries, wrong only in the direction of surplus (address space never faulted in). THEORY, as of Sept 2026: a bound is a claim about the input; a claim with no witness is a guess that fails in silence when the input grows past the day it was typed, and the estate has now paid for that three times in ONE file. The language shape is therefore: (a) a pool is sized by a pass over the thing it will hold; (b) where the size is genuinely unknowable in advance (a network body), the bound is NAMED for that one purpose and its exhaustion ANNOUNCES; (c) a const that sizes anything carries, in its own comment, the measurement or the spec it came from, so a reader can re-derive it. Done when: (1) count_global_tokens lands, nx_wgsl builds past 4096 and the guard stays armed (a planted under-count refuses BY NAME, bite-proven); (2) a census organ walks the toolchain closure (nx_types, nx_lex_kinds, nx_tokenizer, nx_parse, nx_ir, nx_opt, nx_x86_64_ctx, nxasm_x86, nx_compile_x86) and lists EVERY const that sizes a pool, cap, buffer or table with a derivation class -- DERIVED-FROM-INPUT, EVIDENCED (the adjacent comment names a measurement or a published spec) or BARE -- published on this page, BARE ratcheting to zero; (3) the research is fetched, pinned and cited (candidate sources to fetch, NOT yet citations: Zig std allocator and ArrayList growth, Rust Vec amortised growth and the RFC on capacity overflow, LLVM SmallVector, the Go slice growth policy, plus the estate's own three pool incidents as the measured cost) so the principle is a written part of the NishiLang shape rather than a memory
Matrix cell	NO-MATRIX-ROW — no matrix row carries `count_global_tokens`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Design rows	LD6 A number is derived from the resource it describes, never a literal renamed into a constant adopted
Work log	2026-09-06 queue FLAGGED from the gameengine lane (GE59, the cast fragment transcription), which lands only the compiler half here and does not take the census or the research: the compiler fix is three anchored edits on nx_parse.nx (NX_PARSE_GLOBALS_SLACK named; count_global_tokens beside count_func_tokens; parse_module sizes globals_cap from it) and a message-fidelity fix owed in nx_ir.nx, whose three identical ir_add_global_* refusals say `raise the derivation in ir_module_new` -- a hand-copied paraphrase that names the wrong site (parse_module is the allocator for every compiled unit; ir_module_new serves hand-built test modules) and cost one seat the first look. Ship path: /api/build or nx_sov_build_run nx_compile_x86 + nxasm_x86_main (the sibling LN42 assembler change rides along, matched pair), nx_stage_alias to nx_cc_sovereign.elf.new and nxasm_x86_main.elf.new, /api/promote_toolchain each (canary + .prev bank + auto-rollback), then rebuild the consumer. The estate-wide half (every domain's declared numbers) is CQ13 on codequality 2026-09-06 land THE COMPILER HALF IS LIVE: nx_parse.nx count_global_tokens (TK_STRING + TK_STATIC + TK_FLOAT + TK_FLOAT_F32 + TK_FUNC) + NX_PARSE_GLOBALS_SLACK=256 replace the declared NX_PARSE_GLOBALS_CAP=4096 in parse_module (three anchored CAS edits, 438094 -> 440388 B); nx_ir.nx's three ir_add_global_* refusals now name parse_module as the derivation site (message fidelity; nx_ir.nx is CRLF, so every cross-line anchor needs a carriage return). nx_compile_x86 built through /api/build (973080 B, sha 42b1602e, src_path verified, src_stable=1; the prior sibling stage 962592 B was banked as .prev by the build itself), bridged to nx_cc_sovereign.elf.new by nx_filecopy (verified, hash equal), and /api/promote_toolchain returned TOOLCHAIN-PROMOTED canary=GREEN prev=1 -- buildroot/_offc/nx_cc_sovereign.elf now hashes 42b1602e. The assembler was rebuilt byte-identical to live (a0dbf8f3, 176048 B) so the pair needed one promote. Remaining under this rung: the nx_wgsl rebuild past 4096 (measurement pending), the planted under-count bite, the census organ and the research/refs (queue row above) 2026-09-06 measure THE UNIT THAT STOPPED AT 4097 NOW BUILDS: nx_wgsl (shader front-end + both backends + world + cast vertex + cast fragment slice 1) compiled under the promoted compiler 42b1602e -- 1057504 B debug, sha 8db821ce, 875 subprograms, 18144 debug-line rows -- with no pool refusal, where the same source had stopped at `global pool ... measured 4097 against a cap of 4096` under b89d6092. The guard is unchanged and still armed (ir_add_global_* assert against globals_cap); what changed is that globals_cap is now a pass over the token stream plus a named slack. Owed under this rung: the planted under-count bite (a fixture whose synthesised globals exceed the slack must refuse BY NAME, proving the guard is not vacuous after the derivation), the census organ and the pinned research

LN61 Verifier-in-the-loop compiler door · cell WATCHING · gate NO-GATE-DECLARED

Contract	`vl_retry_until_green` · executor Organ · 4 u · stands on LB0
Definition of done	The September-2026 shape for making a weak or local model produce correct programs in a language it does not know. Eiffel-tools [eiffeltools-2609-03086] pairs a language server with a STATIC VERIFIER and retries until the program verifies, fixing 76 to 95 percent of bugs across two datasets and three models, and the verifier is what carries the correctness rather than the model. We already own the harder half: nx_cc refuses, and the gates decide. What is missing is a MACHINE-READABLE refusal plus a retry protocol a weak engine can drive without a frontier model in the loop, so that compiler refusals become a control signal instead of prose a human reads. This is the highest-leverage rung on the board because it converts all future organ authoring from frontier-token work into local work, and organ authoring is currently the frontier seat's entire residual against the 96-new-token local ceiling. Done-rule: a local engine reaches a declared first-try-green rate on a held-out organ set, measured by the incumbent nx_build_firsttry_lib and not by a new ruler.
Matrix cell	Verifier-in-the-loop compiler door (lang LN61) · `runtime/nx_verify_loop_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_verify_loop_lib`; declare `nx_verify_loop_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD7 Every organ ships with a gate that bites a planted known-bad adopted
Work log	2026-09-06 retract SCOPE CORRECTION BEFORE ANY WORK STARTS ON LN61 LN62 LN63: THESE THREE LARGELY DESCRIBE CAPABILITY THE ESTATE ALREADY BUILT IN JULY 2026 AND I PROPOSED THEM AS NEW. NISHI-FORGE is the incumbent and it is the same shape: nx_forge is the driver (task spec to pack to model to lane build to BYTE-EXACT judge to bounded repair, ledger appended) gate 5/5; nx_forge_ctx emits the pack FROM SOURCES with live stdlib signatures gate 7/7; nx_forge_model is the model backend proven over live loopback gate 6/6; nx_lib_std is the sovereign libc gate 13/13; the vetted-rules registry carries 16 rows that RETIRE their own stale bans; a coding compare board was authored. Its pilot MEASURED the exact thesis the September literature reports: haiku RAW 0 of 3, haiku plus PACK 3 of 3, fable plus PACK 3 of 3, i.e. harness parity at the small-organ tier, with the lift coming from VERIFIED CONTEXT rather than scale or iteration. So LN61 to LN63 are REPOINTED from build to COMPOSE, and the honest remaining gaps are the ones FORGE itself named and could not reach: N6 BATCHED PREFILL, because per-token prefill at 2.4 tokens per second makes a 1300-token pack about nine minutes per task and that is what actually blocks the local tier, and N3 BEST-OF-N pick-first-GREEN, which the free deterministic verifier makes cheap for us. What September ADDS is not the harness but three corrections to its priorities, recorded in the sibling measure row. 2026-09-06 measure WHAT SEPTEMBER 2026 ACTUALLY ADDS TO NISHI-FORGE, WHICH IS NOT THE HARNESS BUT THREE CORRECTIONS TO ITS PRIORITY ORDER. ONE, best-of-N moves to the FRONT. FORGE ranked N3 pick-first-GREEN third; GenCorrect [gencorrect-2609-02849] measures five refine rounds worth 177 points against 161 for ALL post-training on the same model, and 198 points on a model with no code-specific RL at all, so the loop outperforms training and it is the rung our free deterministic byte-exact judge makes cheapest in the estate. TWO, the LOCAL TIER TARGET IS PROBABLY WRONG BY AN ORDER OF MAGNITUDE. FORGE staged Qwen2.5-Coder-0.5B and measured a 0 of 3 floor; HEART [heart-2609-01736] reaches 84 percent task completion against GPT-5.4 at 20 with a Qwen3-8B backbone across Planner, Router, Verifier and the tool primitives. An 8B tier also changes the N6 prefill arithmetic, so the tier choice and the batched-prefill rung must be decided TOGETHER rather than in sequence. THREE, PrEx [prex-2609-00579] sharpens WHY the pack works and therefore what a pack should contain. FORGE reasoned that no frontier model has NishiLang in weights so verified facts beat parameters; PrEx measures that models do not apply semantics handed to them at all and are WORST under KeywordSwap and KeywordObf, exactly our case of C-like symbols with different meanings. So a pack lifts by supplying VERIFIED EXEMPLARS TO IMITATE, not by teaching rules, and every future pack rung should weight exemplars and live signatures ABOVE prose rules. The FORGE emitter already does this by construction, which is why it worked.

LN62 The estate as a retrieval-time tool catalogue with a router · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`tp_route_primitive` · executor Organ · 4 u · stands on LN61
Definition of done	HEART [heart-2609-01736] is this estate's own thesis measured by someone else, and its full text is stronger than its abstract: the backbone is Qwen3-8B, an 8B OPEN model, driving Planner, Router, Verifier and the Tool Primitives themselves, reaching 84 percent task completion on 50 real-world tasks against GPT-5.4 at 20 and Claude-4.6-Sonnet at 24, at up to 7.4 times lower API cost, and HEART on Qwen3-8B matches the GPT-5.4 hybrid on most metrics at over 12 times less cost. Two design points transfer directly. Tools are wrapped so SCHEMA RESOLUTION HAPPENS INSIDE THE TOOL rather than by enumerating raw API schemas in the caller's context, and the orchestration layer and the execution layer scale INDEPENDENTLY. We already hold the catalogue of roughly 940 registered tools, the retriever in nx_capsearch, the Verifier in the gate fleet and a Planner in nx_goalmap and nx_compare_rank. The thin part is the ROUTER and the natural-language tool wrapper. Done-rule: a local engine completes a declared task set through the router at a measured cost ratio against the frontier path, with the ratio published beside the completion rate so a cost win that loses quality is visible as a regression.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `tp_route_primitive`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN63 Test-time generate-evaluate-refine for organ authoring · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`gc_refine_round` · executor Organ · 4 u · stands on LN61
Definition of done	GenCorrect [gencorrect-2609-02849] decomposes cleanly in full text and the decomposition is the argument: Nemotron-3-Nano-CC at 3B ACTIVE parameters goes 130 to 280 after SFT to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, past the 438.3 gold threshold. Post-training bought 161 points and the test-time loop bought 177, and the Ultra model gained 198 points from the loop with no code-specific RL at all. The transfer is exact: propose N organ candidates, run the GATE on each, refine from the gate's own output, repeat within a declared round budget. The estate already owns every piece except the loop itself, in nx_gate_bite and nx_sov_build_run with build-only. This is the direct answer to the 96-new-token local ceiling, because the loop trades ROUNDS for parameters rather than needing a bigger model. Done-rule: a declared organ set is authored to gate-green by a local engine within a named round budget, with the round count and the budget both published, and a neg-control organ that must NOT reach green.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `gc_refine_round`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN64 A compact model-facing view of the IR · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`mir_emit_compact` · executor Organ · 4 u · stands on LN61
Definition of done	PrEx [prex-2609-00579] settles what NOT to build here: models lean on pre-training priors rather than applying semantics handed to them, and are WORST under KeywordSwap and KeywordObf, the shifts where familiar symbol meanings must be overridden. NishiLang is exactly that case and worse, because it resembles C without matching it, so a model's priors are ACTIVELY WRONG rather than merely absent, and the failure direction is the flattering one since models frequently declare invalid programs executable. So no spec-stuffing and no fine-tuning rung will be opened on this board. What DOES transfer is representation: measured on a quantized local model, a compact control-flow representation fit the context where the AST overflowed, and REPRESENTATION CHOICE BEAT MODEL SIZE. We already have an IR. Emit a compact model-facing VIEW of it so the local ceiling rises without anyone claiming the model understands the language. Done-rule: the view is emitted from the existing IR with no second IR created, and a declared task set measures higher local first-try-green with the view than without it, the comparison run on the same engine.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `mir_emit_compact`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN65 Population-complete research currency, mechanically verified · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ac_census_complete` · executor Organ · 4 u · stands on LB0
Definition of done	The sotabar and barscan law needs an attestation that a month's listing was actually READ, and until now that attestation was a seat's word. nx_arxiv_census composes the incumbents rather than duplicating them, taking se_fetch from nx_search_extern and em_int_after with em_collect_yms and em_maxym from nx_search_emerge, and asks the ONE question neither incumbent asks: does opensearch:totalResults reconcile against the entries actually delivered. Equal means the window is a POPULATION and an absence claim over it is sound; fewer means a SAMPLE wearing a population's clothes and absence over it is UNPROVEN. This is what converts the measured zero behind sb-slm-code-whitespace from an assertion into a verdict, and it also produces the barscan newest= field mechanically via em_maxym. The currency control for the agent bar is the SWE-bench listing [arxiv-swebench-2026-09]. Done-rule: the organ exits COMPLETE on a window whose counters reconcile, CAPPED on one where max_results truncates the population, and a bite plants a deliberately truncated window that MUST be named CAPPED rather than passing.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ac_census_complete`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN66 The dot builtins lower on every door · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`wat_lower_q8blkdot` · executor Organ · 3 u · stands on LN33
Definition of done	__i16_dot and __q8blk_i16dot (OP_I16DOT, OP_Q8BLKDOT) lower only in nx_x86_64_ctx today, so a source that composes them cannot be built for the wasm or rv64 doors; the ONE SOURCE, MANY DOORS order (2026-09-03) requires a lowering on each door: nx_compile_wat lowers both ops to i16x8 and i32x4 SIMD where the profile has v128 and to a plain loop under --nothreads or a v128-less profile, the rv64 emitter lowers to a scalar loop first (the vector extension later), and the feature program _q8blkdot_minrepro.nx must exit 0 on every door it is built for. DONE-RULE: nx_cc_equiv_gate's feature leg runs the minrepro through the wat door in the estate wasm VM (nx_wasm_vm_verify) and through nx_rv64_sim with exit 0 on both, and the widest-block and most-negative-block answers are byte-identical on all three doors; a door that lacks the lowering must REFUSE the op by name at compile time, never emit a silent zero
Matrix cell	NO-MATRIX-ROW — no matrix row carries `wat_lower_q8blkdot`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Design rows	LD18 Whole-stack co-design from the bit up: every layer is written in one language and designed together, so an optimisation is judged by the whole system's number, never the rung's alone adopted
Work log	2026-09-17 queue Declared from the search R0s-b lane (2026-09-17): __q8blk_i16dot shipped x86-only (toolchain b4310ac4, canary GREEN, equiv 10/10 + selfhost + feature on both hosts); nx_compile_wat and the rv64 emitter carry no OP_I16DOT or OP_Q8BLKDOT case (only nx_ir.nx, nx_types.nx and nx_x86_64_ctx.nx name the ops), so nx_nofloat_q4k.nx and every engine source composing the builtins are x86-only until this rung lands; recipe: add the two cases to the wat emitter beside the OP_ATOMIC lowerings, a scalar case to the rv64 emitter, extend the equiv gate's feature leg with a per-door run, bite the wat case by deleting it and requiring a named refusal 2026-09-17 land BOARD UN-REFUSED: nx_compare_rank had refused the whole lang board rc=7 (GRAPH malformed=9 missing_deps=1) because nine rung rows authored 2026-09-03 (LN36 LN37 LN38 LN39 LN40 LN41 LN42 LN45 LN46) carried 5 fields where the graph ruler expects 8, and LN49 depends on LN46; each row received its three missing fields (kind Organ, NOMINAL units 1 with LN42 at 2, deps LN38 on LN37 and LN41 on LN33, the rest none) by anchored edits whose predicted final size 233,728 B matched to the byte (seven rows were CRLF-terminated, two LF); the units are a nominal schema repair the lang seat may re-price; a one-call publish plan boardship-lang was seeded (rank, scoped regen, page verify) so this board ships the way search does

LN67 Superiority scorecard: every axis measured against every rival · cell LANDED · gate NO-GATE-DECLARED

Contract	`ls_scorecard` · executor Organ · 3 u · stands on LN22
Definition of done	An organ composes the incumbents (nx_lang_h2h for speed with its checksum, the build lane for compile time and binary size, the Energy-Languages method for energy, the safety-class census, the graded diagnostics of LN49, the tooling-ring rows) into ONE receipt per rival per axis reading WIN LOSE TIE or UNMEASURED with the number beside each, rendered on the board and appended to a spine so the climb is a trajectory; the gate proves a planted loss cannot read WIN and an unmeasured axis cannot read TIE; PRE-DECLARED: the first receipt reads LOSE on speed, because the 2026-09-01 h2h bench measured NishiLang checked at 3.33x gcc -O2 and 1.6x Rust checked, and that number is the first bar to beat
Matrix cell	Superiority scorecard: every axis measured against every rival · `runtime/nx_lang_scorecard.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_scorecard`; declare `nx_lang_scorecard TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-22 land 2026-09-22 the operator's standing order landed as data: goal row rewritten, sotabar sb-lang-rivals (Rust 1.98.1, GCC 16.2, Go 1.27.1, Zig 0.16.0, read from mirrored pages), target lt-superior (WIN on every rival axis by the scorecard, alone on the sovereign axes), rungs LN67 scorecard and LN68 rival bars, and the first ten design rows: the choices already made to keep the human side from erring, each with the error class it prevents, its source kind, its evidence and its measured effect or UNMEASURED 2026-09-22 lesson Superior is not a slogan and not a clone: it is a per-axis WIN against a named rival version, plus the axes nobody else has. The board carries the design choices as rows so the reason for each is read, not recalled, and the emitter renders the same ledger for every domain (ecosystem EC66) 2026-09-22 measure 2026-09-22 first render of the design ledger on this page (ecosystem EC66 landed): rows 10 = adopted 7 + proposed 3 + retracted 0 + refused 0 + malformed 0, unmeasured claims 2, evidence tokens 17 with 0 dead (LR1 and LR2 resolve as rung ids on this plan, not reference keys), verdict CLEAN; the emitted page carries 10 design rows and no raw design row text; page grew 852735 to 858712 bytes, the table 2026-09-22 land 2026-09-22 nx_lang_scorecard (ls_scorecard: one WIN, LOSE, TIE or UNMEASURED per rival per axis from lang.sota grades on the B > Y > ~ > n ladder and the lang.bench medians for the speed axis, default build and f1 mode each a row; SUPERIOR only when every rival axis is a WIN; rival cells dated by the new @cellsasof line of lang.sota, 2026-07) built sovereign; its gate reads 29/32 on the first run with all three reds in the fixture's own arithmetic (two n-vs-n ties, not one); the first real run read UNREADABLE because the qualify lane anchors CWD to buildroot and the organ spelled one tree -- rewired to nx_comparetree_lib before the first receipt is written 2026-09-22 measure 2026-09-22 FIRST SCORECARD RECEIPT (nx_lang_scorecard, gate 32/32 GREEN, artefact knowledge/compare/lang.scorecard in the published tree): rivals 11, axes 35, rows 396 = win 118 + lose 131 + tie 98 + unmeasured 49, superior=NO. Per rival (win, lose, tie, unmeasured): Rust 8 17 8 3; Zig 9 7 15 5; Go 10 17 6 3; Swift 9 14 8 5; Kotlin 9 13 9 5; TypeScript 11 11 9 5; Python 14 9 8 5; C 20 3 10 3; Elm 10 12 9 5; OCaml 9 14 8 5; Haskell 9 14 8 5. The speed axis from the receipt: default build LOSE to C (7096 vs 2061 us), Rust (4335) and Go (4154); f1 mode WIN over Rust checked (4176 vs 4335) and LOSE to Go by 22 us (4176 vs 4154) and to C. Rival cells are dated 2026-07 (@cellsasof), so every WIN is a win at the July versions until LN68 refreshes the cells to the September bars. The 131 LOSE rows are the language's work order and the ranker reads them through the rival columns 2026-09-22 queue 2026-09-22 nx_lang_scorecard is BUILT at buildroot/_build and deliberately NOT promoted this pass: its representative run exits 1 by design (NOT-SUPERIOR is the honest verdict) and the ship loop's behaviour qualification reads a non-zero exit as a failed probe; owed: a report verb that exits 0 for probing while the verdict verb keeps its exit code, then nx_organ_ship, register, and a scorecard render pass in the emitter (the .scorecard file beside .bench, one reader) so the per-rival table is on the lang page 2026-09-22 queue 2026-09-22 COORDINATION CONTRACT (operator: get the work going along with the language work as they make logical sense together). Owners: the RACI row LANG-superiority-program; the ritual plan-lang-board-hygiene- runs before any rung is touched; the playbook names the loop. The crew's first three language rungs in order: LN80 the zero add-on census (cheap, and it feeds both the autodev mining lane and the lifecycle ruler, ecosystem EC71), LN70 serial elision verified by the compiler (the oracle every fluid shape is checked against), LN74 energy on the receipt (before anyone claims energy). Every language rung that supersedes an organ (LN78 unifying the math organs, LN71 replacing hand loop shapes) files lifecycle rows for what it supersedes the same hour, with the successor named, and leaves no parallel tool: the language climb and the lifecycle discipline are one motion. The scorecard receipt is re-run after every landed rung and its LOSE count is the number the crew reports 2026-09-22 land 2026-09-22 nx_lang_scorecard SHIPPED sha 039a192fdc0acc39351c1156e229cb6c4fa7a8b4ad0c925bbdcfcd28a05d0b9f through nx_organ_ship (gate 32/32 rebuilt in the loop, first-time organ so no incumbent to lose), REGISTERED callable, gate on the roster, clock row langscorecard 86400 ./nx_lang_scorecard.elf put so the per-rival receipt is re-derived daily and its LOSE count is a trend; the ls_scorecard contract flips on the next lang regen; still owed: the .scorecard reader in the emitter so the table renders on this page 2026-09-22 measure 2026-09-22 LIVE PAGE WITNESS after the scoped regen (SCOPE-FILE domain=lang, forkchecked 4 forkfresh 4, published 3, verdict GREEN; nx_page_verify GREEN a11y 0): the ls_scorecard cell reads measured present (ls_scorecard exists in runtime/nx_lang_scorecard.nx, verified at emit) with the state registered-unauthorised, and the la_addon_census cell reads exceed (source present, verified at emit) with the state lib-uncensused. Both residual states are rituals, not defects: registered-unauthorised clears when nx_toolreg_reconcile runs and a cap names the verb; lib-uncensused clears when nx_eco_graph_build then nx_importcensus re-run so the importers table sees the new lib (the recipe on the datavis board). The scoped regen raced on the shared scope file for the THIRD time today (a sibling wrote cms between two of this seat's writes; a run republished cms before the lang run): EC67 stands as the remedy, no workaround taken 2026-09-22 measure 2026-09-22 shipping the scorecard section into nx_swcompare_matrix: the content ruler named two lost runs, both one diagnostic string, the seg-store refusal SS-COMMIT REFUSED segid (seq1730) NOTHING WRITTEN, which the live generator (built earlier tonight) carries and the candidate does not. Attribution before approval: buildroot/runtime/nx_seg_store.nx no longer contains that string (count 0 over 259249 bytes), so a sibling lane reworded or removed the refusal upstream after the live build and the candidate correctly lacks it; the loss is not this rung's change and was approved by its exact token only after that read. The scorecard section itself only GAINS runs 2026-09-22 lesson 2026-09-22 an approved loss token is bound to the EXACT candidate artifact, and the second ship of the matrix generator produced a different candidate sha with the same two lost runs (evidence 4546 bytes, identical LOST lines): the closure had moved under a concurrent seat between the two builds, so the first token no longer named the artifact and the loop correctly asked again. Re-approved by the new token after re-reading the record; the rule holds: read the LOST lines every time, never carry a token across builds 2026-09-22 land the scorecard section is PUBLISHED: nx_swcompare_matrix 04c61be8 shipped on attempt 6 (loss token re-issued three times as sibling edits to nx-shell and nx_compare_garden_lib moved the closure; the two lost runs were always the upstream SS-COMMIT REFUSED strings; the lang behaviour probe was accepted by the loop), buildroot/_offc twin refreshed and hash-verified 04c61be8, scoped regen GREEN forkfresh=4 published=3, /compare/lang carries id=scorecard and api.json carries scorecard rows=396 win=118 lose=131 tie=98 unmeasured=49 superior=0 rivals=11 cells_asof=2026-07, nx_page_verify GREEN 200 a11y 0 2026-10-01 measure BARFRESH 2026-10-01 (seat residue-fleet, T0 1790856940): before STALE with 12 of 12 bars UNATTESTED on the October clock. Page bars handled from bytes re-fetched and read this month: sb-lang-rivals RE-DATED 2026-09 to 2026-10 (releases.rs now lists Rust stable 1.99.0, the beta that was due 1 October; any scorecard row that names Rust 1.98.1 now names a superseded rival version, a re-measure this seat did not make) and SB-LANG-ARENAS ATTESTED at 2026-09 (DARPA opportunities feed, 10 items, newest pubDate 29 Sep 2026, none in October). Left for the arXiv attest runner and NOT fetched by this seat: the ten bars whose refs are keyed arxiv- (arxiv-msc-2026-09 and arxiv-qphot-2026-09 verified as export.arxiv.org urls, the other refs taken by key name): sb-weakmodel-code, sb-semantics-in-context, sb-slm-code-whitespace, sb-agent-accept, sb-lang-frontier, SB-LANG-FLUID, SB-LANG-ONELANG, SB-LANG-DOMAINS, SB-LANG-DOORS and SB-TESTING. The GCC, Go and Zig release pages were not re-read. The page needs a regen.

LN68 Rival release bars as data on a beat · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ls_rival_bars` · executor Organ · 1 u · stands on LN67
Definition of done	The four release pages are fetched monthly, the current versions parsed into a pinned bar row, so every WIN or LOSE names the rival version it was measured against; the gate proves a planted version change flips the bar and an unchanged page leaves it
Matrix cell	Rival release bars as data on a beat · `runtime/nx_lang_scorecard.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_scorecard`; declare `nx_lang_scorecard TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN69 Mode fit: the container's measured envelope chooses the mode · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lm_fit_mode` · executor Organ · 3 u · stands on LN67
Definition of done	OPERATOR 2026-09-22 verbatim: the goal is getting the most optimal nishi language that can shift between energy efficient, speed, balance between both, and other capabilities like switching cars between races with the ai being able to use what is most effective where so its not locked in but a structured fluid like water in a container that it matches to the containers physical literal limits and needs not just one size fits all. nx_lang_modefit_lib lm_fit_mode reads the container's envelope as DATA (the tier ladder rows: cores, memory pages, thermal and energy budget, latency floor; nx_energy_probe where the host exposes RAPL) and the declared mode bundles (knowledge/lang_modes.conf), scores each bundle's measured receipt (lang.bench gains an energy column per arm: package joules per workload on hosts that expose it, UNMEASURED elsewhere) against the envelope, picks the bundle that fits, and prints the door taken and the reason (the HUD door line pattern) so a choice is never silent; a seat or an AI may override with a declared reason, never by a bare flag. Done-rule: one source built for three declared containers (a sensor-class envelope, the laptop, the NAS) yields three artefacts each inside its container's declared limits with a receipt per container, the scorecard gains an energy axis from the receipt, and the gate plants an envelope no bundle fits and proves the refusal by name
Matrix cell	Mode fit: the container's measured envelope chooses the mode (lang LN69) · `runtime/nx_lang_modefit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_modefit_lib`; declare `nx_lang_modefit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD12 Water in a container: one source, and the artefact takes the shape of the container it is poured into -- energy-lean, fastest, balanced, safest -- chosen by the container's MEASURED physical limits and needs, never one size fits all proposed
Work log	2026-09-22 lesson 2026-09-22 the modes were built as data on 2026-09-01 and measured on 2026-09-01; the choice between them has been a seat's hand ever since, which is exactly the one-size-fits-all the operator refuses wearing a mode's name 2026-09-22 measure 2026-09-22 RESEARCH READ (six sources fetched through the sovereign fetcher, pinned, read from the mirrored bytes): the field separates WHAT a program computes from HOW it runs along four seams -- the schedule (Halide), the mapping (Legion), the scheduler (OCaml 5 effect handlers), and the serial reading every parallel form is verified against (OpenCilk; Exo-GPU this month) -- and MLIR makes the target itself a lowering table. NishiLang has none of the four seams today: parallelism is a library call, the loop shape is the source, control flow has no continuation, placement is where the code runs, and the doors are hard-coded. The modes as data (2026-09-01) were the first seam and they select flags, not shapes 2026-09-22 queue 2026-09-22 order of climb: LN70 first (the sequential meaning is the oracle every other shape is verified against, and the estate's determinism checksum makes the verification free), then LN71 (the schedule as data over the head-to-head loop is the fastest measurable win), LN74 (energy on the receipt before anyone claims energy), LN72 and LN73 (handlers and mapper), LN75 (doors). Each lands with a receipt on one checksum and a gate that plants the forbidden shape

LN70 Serial elision by construction: every parallel construct has a sequential meaning and the compiler verifies the two agree · cell WATCHING · gate NO-GATE-DECLARED

Contract	`se_elide` · executor Organ · 3 u · stands on LN17, LN6
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: parallelism is a library call (nx_pool_submit) with no sequential reading the compiler knows, so a program cannot be built single-threaded for the smallest container without a rewrite. nx_serial_elision_lib se_elide gives every parallel construct (a parallel loop, a spawned task, a sync) its sequential elision and verifies sequential-parallel equivalence on the determinism checksum the estate already demands (no floats, bit-exact), refusing by name a construct whose parallel meaning differs [arxiv-fluid-2026-09] [opencilk-site]. Done-rule: the head-to-head loop and the thread-pool workloads build serial and parallel from ONE source with identical checksums and both medians in the receipt; the gate plants a construct whose parallel meaning differs and proves the refusal
Matrix cell	Serial elision verified by the compiler · `runtime/nx_serial_elision_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_serial_elision_lib`; declare `nx_serial_elision_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD13 Parallelism is an annotation on sequential code, verified equivalent by the compiler proposed
Work log	no log row names this rung yet

LN71 Schedule as data beside the algorithm · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sc_schedule_apply` · executor Organ · 4 u · stands on LN70, LN69
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the loop shape IS the source, and the f1 and drag modes are flag bundles that elide checks, not schedules. nx_schedule_lib sc_schedule_apply reads a .schedule conf per hot loop (tile, vectorize, parallel, unroll, compute-at, the Halide vocabulary) and applies it in the compiler, never in the source; a schedule that changes a result is refused, since a schedule may only change order and locality [halide-site]. Done-rule: three schedules over the head-to-head loop, one checksum, three medians in the receipt, chosen by LN69 from the container
Matrix cell	Schedule as data beside the algorithm · `runtime/nx_schedule_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_schedule_lib`; declare `nx_schedule_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD14 The schedule and the mapping are data, orthogonal to correctness proposed
Work log	no log row names this rung yet

LN72 Effect handlers as the one seam between user code and its scheduler · cell WATCHING · gate NO-GATE-DECLARED

Contract	`eh_handle` · executor Organ · 5 u · stands on LN70
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: control flow is calls and returns; there is no continuation, so sequential, asynchronous and parallel execution of the same code need three programs. nx_effect_lib eh_handle brings one-shot delimited continuations and effect handlers, so user code stays in direct style and the sequential, async and parallel schedulers are handlers written in NishiLang itself [ocaml53-effects]. Done-rule: one program run under three handlers with identical checksums; a planted second resume of a one-shot continuation is refused by name
Matrix cell	Effect handlers as the scheduling seam · `runtime/nx_effect_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_effect_lib`; declare `nx_effect_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD15 Effect handlers are the one seam between direct-style user code and any scheduler proposed
Work log	no log row names this rung yet

LN73 Mapping orthogonal to correctness · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mp_map` · executor Organ · 3 u · stands on LN69, LN72
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: placement is wherever the code runs; there is no mapper, so a change of core, memory or door is a change of program. nx_mapper_lib mp_map decides where tasks run and where data lives from the container envelope LN69 reads, and the language guarantees a mapping decision can change timing and never a result [legion-overview]. Done-rule: two mappers over one program, identical checksums, different medians, both in the receipt
Matrix cell	Mapping orthogonal to correctness · `runtime/nx_mapper_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mapper_lib`; declare `nx_mapper_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD14 The schedule and the mapping are data, orthogonal to correctness proposed
Work log	no log row names this rung yet

LN74 Energy is a receipt axis · cell WATCHING · gate NO-GATE-DECLARED

Contract	`en_joules` · executor Organ · 2 u · stands on LN67
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: energy is not measured on any arm; the only energy evidence on this board is the field's per-language study [energy-languages]. nx_energy_receipt_lib en_joules adds package joules per arm to lang.bench on hosts that expose RAPL (nx_energy_probe) and UNMEASURED elsewhere, and the scorecard gains an energy axis per rival with an arm. Done-rule: the receipt carries joules for every arm on the laptop host and the scorecard prints the energy verdicts
Matrix cell	Energy on the receipt · `runtime/nx_energy_receipt_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_energy_receipt_lib`; declare `nx_energy_receipt_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN75 Doors as lowering dialects, refusal never fallback · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dr_lower_door` · executor Organ · 4 u · stands on LN73
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: x86-64, rv64 and wasm are hard-coded backends; a GPU, a quantum or a photonic target has no door and no refusal, it simply cannot be named. nx_door_lower_lib dr_lower_door makes each target a declared lowering table (the MLIR dialect shape) so a new substrate is a door added as data on one source, and an absent door is a NAMED refusal [mlir-site]. Done-rule: the three live doors lower through the table byte-identically to today, and a declared-absent door (gpu, quantum, photonic) refuses by name with the rung that will open it
Matrix cell	Doors as lowering dialects · `runtime/nx_door_lower_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_door_lower_lib`; declare `nx_door_lower_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD16 A target is a lowering dialect added as data; an absent door refuses by name proposed
Work log	2026-09-22 queue 2026-09-22 a fourth door named from the electronics frontier (ecosystem EC74): the hardware description of the estate's own core as a lowering dialect of the same source, beside x86-64, RISC-V 64 and wasm; and the DSSoC idea of a runtime routing work across heterogeneous cores without recompiling is LN69 mode fit plus LN73 mapper with the silicon as one more container. Both are placed on the ladder before any source is read; every claim about them waits for the read

LN76 Compile-time execution of the language itself · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ce_comptime_eval` · executor Organ · 5 u · stands on LN17
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: there is no compile-time execution and no staging, so anything computed at build time is either a constant somebody typed or a generator organ writing source. nx_comptime_lib ce_comptime_eval runs ordinary NishiLang at compile time (the Zig mechanism, never a macro language), deterministically on the integer lane, so tables, types and code shapes are computed by the same language that runs them [zig-overview]. Done-rule: a comptime-computed table is byte-identical to the hand-typed one it replaces across the equivalence net and self-host; the gate plants a comptime program that reads the clock or the host and proves the refusal by name
Matrix cell	Compile-time execution of the language itself · `runtime/nx_comptime_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_comptime_lib`; declare `nx_comptime_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD17 One language that extends into every domain from within: no add-on, no second language, no foreign runtime proposed
Work log	2026-09-22 measure 2026-09-22 RESEARCH READ (five sources fetched sovereignly, pinned, read from the mirrored bytes): the field's answer to scattered tools is extension from within -- comptime (Zig), syntax elaborated in the language (Racket, Lean), one language for numerics (Julia), and this month an embedded language with its own proof mode written in Lean through Lean's metaprogramming. NishiLang has no compile-time execution, no syntax extension, no proposition in the language, a scatter of math organs with no language reaching them, and no count of the foreign programs its workflows still fork 2026-09-22 queue 2026-09-22 order of climb: LN80 first (the add-on census is cheap and makes the scatter a falling number), LN76 (comptime is the substrate for everything else and its refusal of nondeterministic inputs is the determinism guarantee), LN77, LN78 (the mathematician's stack over the estate's existing math organs), LN79 last (the frontier)

LN77 Syntax extension elaborated in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sx_extend` · executor Organ · 5 u · stands on LN76
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the grammar is the parser's and only the parser's; a matrix literal, a sum, a unit or a query is prose in a string or a call chain. nx_syntax_ext_lib sx_extend lets a declared notation elaborate to core NishiLang at compile time through comptime (the Racket and Lean shape), so a domain reads in its own notation and compiles through one toolchain [racket-site] [arxiv-onelang-2026-09]. Done-rule: a matrix literal and a summation notation elaborate to core code that is byte-identical to the hand-written form; a notation that elaborates differently on two hosts is refused by name
Matrix cell	Syntax extension elaborated in the language · `runtime/nx_syntax_ext_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_syntax_ext_lib`; declare `nx_syntax_ext_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD17 One language that extends into every domain from within: no add-on, no second language, no foreign runtime proposed
Work log	no log row names this rung yet

LN78 The mathematician's stack in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mx_exact` · executor Organ · 6 u · stands on LN76, LN77
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the estate's mathematics is a scatter of organs (bigfloat regeneration, nx_matrix_eig, nx_quadrature, nx_f64, nx_mathml, nx_mathcore) each with its own entry and none reachable as language; a person still reaches for Mathematica, Matlab or Python for exact rationals, symbolic differentiation or arbitrary precision. nx_mathstack_lib mx_exact unifies exact rationals, bigints, bigfloat, symbolic differentiation and linear algebra under LN77 notation, deterministically, with Lean and Mathlib, Julia and Mathematica as outside oracles on known answers [julia-why]. Done-rule: the KAT set the oracles agree on passes bit-exactly on both hosts, and a person writes the worked example in NishiLang notation with no other program in the path
Matrix cell	The mathematician's stack in the language · `runtime/nx_mathstack_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mathstack_lib`; declare `nx_mathstack_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD17 One language that extends into every domain from within: no add-on, no second language, no foreign runtime proposed
Work log	no log row names this rung yet

LN79 Proofs checked in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`pv_check` · executor Organ · 8 u · stands on LN77
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: a claim about a program is prose in a comment or a gate; nothing in the language states a proposition or checks a proof. nx_proof_lib pv_check brings propositions as types with a small checked kernel so a theorem about NishiLang code is written and checked in NishiLang (the Lean shape), and Lean is the outside oracle on the same statements [arxiv-onelang-2026-09] [lean-site]. Done-rule: a planted false proof is refused by the kernel, a true one is accepted, and the same statements check in Lean
Matrix cell	Proofs checked in the language · `runtime/nx_proof_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_proof_lib`; declare `nx_proof_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD17 One language that extends into every domain from within: no add-on, no second language, no foreign runtime proposed
Work log	no log row names this rung yet

LN80 Zero add-on ratchet · cell LANDED · gate NO-GATE-DECLARED

Contract	`la_addon_census` · executor Organ · 2 u · stands on LN67
Definition of done	WHERE THE ESTATE CANNOT TODAY: workflows still shell out to python, perl, powershell, pdftotext and curl for pieces the language lacks, and nothing counts them. nx_lang_addons_lib la_addon_census counts every foreign program a workflow, gate or plan plane forks, by name and by the language gap it stands in for, and the number may only fall (the nx_selfsuff family is the incumbent ruler and this composes it). Done-rule: the census prints the partition, names each add-on with the rung that retires it, and the ratchet refuses a rise
Matrix cell	Zero add-on ratchet · `runtime/nx_lang_addons_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_addons_lib`; declare `nx_lang_addons_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD17 One language that extends into every domain from within: no add-on, no second language, no foreign runtime proposed
Work log	2026-09-22 land 2026-09-22 THE ZERO ADD-ON CENSUS, first cut: nx_lang_addons_lib la_addon_census (the estate root DERIVED from the registry's own first nx_ executable, never typed; every executable outside it named with its row; partition rows = estate + foreign + malformed + blank printed) with nx_lang_addons (CLI, registry resolved through the estate's declared root and the absolute path printed) and nx_lang_addons_gate 15/15 GREEN (planted add-on named, clean registry silent, rootless registry UNREADABLE never CLEAN, neg-control bite-proven). Built sovereign, NOT promoted this pass: its honest exit on a registry with findings is 1 and the ship probe wants 0 (the same report-verb-for-probing queue as the scorecard) 2026-09-22 measure 2026-09-22 FIRST RECEIPT on the serving-root registry /volume1/homes/elderwesto/nishihost/tool_allowlist.conf: rows 2125 = estate 2114 + foreign 2 + malformed 0 + blank-or-comment 9 (sum 2125), root derived /volume1/homes/elderwesto/nishihost/. The two rows named are nx_security_census and nx_conn_catalog, registered with executables under /var/services/homes/elderwesto/nishihost/_offc/, the same home under a second mount spelling: not a foreign program, a second spelling of the estate root, which every scanner reads as a different root. So the registry surface carries ZERO foreign programs today and two alias-rooted rows their owners should re-register under the canonical root; the ruler is right to name them and cut 2 classifies an alias as ALIAS-ROOT by directory identity rather than by text 2026-09-22 queue 2026-09-22 cut 2, named not hidden: the clock DESIRED plane, the gate roster, every plan plane (at least 296 plan manifests seen before the 20 s scan budget: a floor, not a total) and the pinned-args column, where a foreign program can hide behind an estate wrapper; an ALIAS-ROOT class by directory identity; a journal row per run so the number is a trend; the report verb that exits 0 so the ship probe qualifies; then promote, register and roster 2026-09-22 land 2026-09-22 nx_lang_addons SHIPPED sha d28e61e07e70a9c17fdc208583c07e56a39d2cfdb81903dda4e0727934a24158 through nx_organ_ship (gate 15/15 rebuilt in the loop), REGISTERED callable, gate on the roster, clock row langaddons 86400 ./nx_lang_addons.elf put so the add-on count on the registry surface is a daily number; the la_addon_census contract flips on the next lang regen

LN81 Whole-system receipts: a language or codegen change is accepted on the engine's number, not the loop's · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ws_whole_receipt` · executor Organ · 3 u · stands on LN67
Definition of done	WHERE THE BOARD CANNOT TODAY: lang.bench measures one hot loop; a change that wins the loop and loses the LLM decode, the emitter's page time or the browser's frame would still read as a win. nx_whole_receipt_lib ws_whole_receipt composes the bench receipt reader with the engines' own timers (the nofloat decode tokens per second on the served gguf, nx_compare_regen seconds per page, the browser frame budget) so every lang rung carries the whole-system receipt beside its loop receipt, on one checksum per engine. Done-rule: the three engine receipts render beside the loop receipt on this page, and a planted change that improves the loop and regresses an engine reads LOSE on the board
Matrix cell	Whole-system receipts beside the loop receipt · `runtime/nx_whole_receipt_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_whole_receipt_lib`; declare `nx_whole_receipt_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-22 lesson 2026-09-22 the whole-stack instance the estate already holds is the proof of the principle: a compiler builtin shaped to the model's block layout (search R0s-b) beat every layer-local optimisation because the layers were designed together in one language; a stack assembled from separate tools cannot make that move, which is the second reason the scatter of add-ons is refused 2026-09-22 queue 2026-09-22 RESEARCH LEADS from the operator, the mechanical-sympathy school (UNREAD: cite nothing until fetched, read and pinned in lang.refs): Muratori, Clean Code Horrible Performance and the reXdev work (layers of abstraction, runtimes and compiler paths making software thousands of times slower than the silicon allows: the measured argument for LD18 whole-stack co-design and for the whole-system receipts LN81); Dan Luu's empirical latency work (input latency, file-system and terminal rendering measured against hardware floors: the instrument shape the browser and NishiOS boards need); Martin Thompson, Mechanical Sympathy and the LMAX Disruptor (cache-line alignment, false sharing, the single-writer principle, lock-free rings: candidate design rows for the language -- data layout that respects the cache as a default, a single-writer discipline the type system can check, no hidden allocation in a hot path). Each becomes a design row with its error class and a rung with a receipt on one checksum only after the source is read; the fluid-shape ladder (LN70 to LN75) is where the cache and single-writer rows attach 2026-09-22 queue 2026-09-22 the language rungs placed on the estate's seam map (ecosystem EC72): seam 1 silicon to microarchitecture is LN74 energy and the integer lane (LD1) with the block-native builtins (LN66); seam 2 microarchitecture to OS is the cache-respecting layout and single-writer rows the mechanical-sympathy leads will ground, attached to LN71 and LN73; seam 3 OS to runtime is the one-language ladder LN76 to LN80 (zero foreign crossings by construction, the add-on census as the ruler); seam 4 runtime to application is LD2 typed arrays, no hidden allocation and LD18; seam 5 application is the whole-system receipt LN81 and the seat's tokens per closed rung. Every rung above now names the seam it heals so the hub can render the climb in real time

LN82 Domain known-answer suites as data with the field's tools as outside oracles · cell LANDED · gate NO-GATE-DECLARED

Contract	`dk_run_suite` · executor Organ · 2 u · stands on LB0
Definition of done	The ruler every domain rung is graded by: knowledge/bench/domain_kat/<domain>.kat rows task-input-expected-oracle-source, the runner drives the estate organ named per row and prints pass, fail and unreachable counts that sum; the first suite is Charlwood's 50 integrals with the SymPy paper's verified answers as the oracle [sympy-charlwood-2609-25616]; today's honest first receipt is 0 of 50 reachable through nx_calc_integrate and the number is printed, never a claim; a planted wrong expected answer must fail (gate)
Matrix cell	Domain known-answer suites with the field's tools as outside oracles · `runtime/nx_domain_kat_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_domain_kat_lib`; declare `nx_domain_kat_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD19 Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate proposed
Work log	2026-09-26 lesson /api/promote read nx_domain_kat as an ORACLE BY ITS NAME (ma_name_is_oracle keys on the _gate, _test and _kat suffixes and never consults organ_kind.conf, as that file's own header records) and refused D001 for a runner that is not a gate; declared oneshot in organ_kind.conf and promoted with allow_own_verdict=yes, named here and not hidden; a classifier that consults ma_kind is the residue on the mgmt API's RACI lane 2026-09-26 land nx_domain_kat_lib + nx_domain_kat + nx_domain_kat_gate shipped: gate 31/31 GREEN through nx_organ_ship (the first cut forked itself with an empty argv, a sentinel written into the splitter's cursor, and ran the whole referee in every child; fixed by a flag-driven scan and a recursion guard on every referee that forks its own binary), organ promoted 60c1840a, registered on the tool surface; the first suite is knowledge/bench/domain_kat/math.kat (6 reachable exact-multiplication rows with CPython products, 10 Charlwood integrals as unreachable rows) 2026-09-26 measure first receipt 2026-09-26 (nx_domain_kat math.kat): rows=16 pass=3 fail=3 unreachable=10 reachable=6, verdict RED; the three FAILs are one finding: nx_mathcore mul answers MATHCORE-REFUSED operand-is-not-an-unsigned-decimal for 18446744073709551615, 12345678901234567890 and 9876543210987654321, so the exact-arithmetic organ's decimal door stops below 2^64 while its product is 128-bit; the pairs (0,0), (2^32,2^32) and (1000000007,998244353) pass with the oracle's product byte for byte 2026-09-26 land nx_mathcore decimal door widened to the whole u64 range (limb-wise parse, a decimal wider than 64 bits refused BY NAME as exceeds-64-bits): nx_mathcore_gate 31/31, shipped through nx_organ_ship with the three lost runs enumerated and approved by their exact token (two refusal literals now composed from parts, the retired mc_put64 symbol name) and a representative live-vs-staged probe IDENTICAL on mul 1000000007 998244353; promoted e77b6206, _offc twin installed 2026-09-26 measure second receipt 2026-09-26 (nx_domain_kat math.kat, after the widening): rows=16 pass=6 fail=0 unreachable=10 reachable=6, verdict MEASURED; every reachable product matches the CPython oracle byte for byte, including (2^64-1)^2 = fffffffffffffffe0000000000000001 and 12345678901234567890 x 9876543210987654321; the ten Charlwood integrals stay UNREACHABLE, which is the honest distance to lt-every-domain on the mathematician's axis until LN83 lands a notation and an integrator that accepts it [charlwood-full-2609-25616]

LN83 The mathematician's notation: exact, symbolic and unit arithmetic as syntax · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mx_notation` · executor Organ · 5 u · stands on LN77, LN78
Definition of done	Exact integers and rationals (nx_bigint_lib, nx_rational), symbolic integration and series (nx_calc_integrate, nx_calc_series) and SI units (nx_units) reachable as notation elaborated in the language rather than as organs a person shells to; done-rule: the Charlwood suite (LN82) improves from its first receipt with every step printed, a unit mismatch is a compile refusal naming both units, and the arithmetic is byte-identical on every door; the bar is FloatLib's certified execution and Lean's in-language extension [floatlib-2609-19352] [garlene-2609-24345]
Matrix cell	The mathematician's notation: exact, symbolic and unit arithmetic as syntax · `runtime/nx_mathstack_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mathstack_lib`; declare `nx_mathstack_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD19 Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate proposed
Work log	no log row names this rung yet

LN84 The economist's stack: tables, least squares and panel models in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ec_ols` · executor Organ · 4 u · stands on LN78
Definition of done	Tables with group-by and join, ordinary least squares, fixed-effects panel and a time-series spine as language values with integer-deterministic arithmetic; done-rule: a KAT over a published dataset reproduces R's lm coefficients to the printed tolerance with R run outside as the oracle, and the DARPA Intrinsic Market Resilience opportunity names the arena an economist's model would enter [darpa-opps-rss-2026-09] [r-sources-2026-09]
Matrix cell	The economist's stack: tables, least squares and panel models in the language · `runtime/nx_econ_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_econ_lib`; declare `nx_econ_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD19 Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate proposed
Work log	no log row names this rung yet

LN85 The writer's stack: sentences, tags and parses as language values · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tx_parse` · executor Organ · 3 u · stands on LN77
Definition of done	The aspect lane's sovereign tagger, parser and CRF (nx_postag, nx_text_sentences, the dependency parser) reachable as language values with a notation for patterns; done-rule: a KAT over a mirrored Universal Dependencies sample with the field's tagger run outside as the oracle, accuracy printed beside the oracle's, never a claim of parity until the number says so
Matrix cell	The writer's stack: sentences, tags and parses as language values · `runtime/nx_text_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_text_lib`; declare `nx_text_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD19 Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate proposed
Work log	no log row names this rung yet

LN86 The chemist's stack: molecules, SMILES and units in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ch_mol` · executor Organ · 3 u · stands on LN77
Definition of done	The molecule graph and SMILES organs (nx_chem_molecule, nx_chem_smiles, nx_chem_smiles_emit) with nx_units as typed quantities; done-rule: a KAT over a mirrored SMILES set round-trips parse and emit and computes formula and molecular weight with RDKit run outside as the oracle, differences printed by row
Matrix cell	The chemist's stack: molecules, SMILES and units in the language · `runtime/nx_chem_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chem_lib`; declare `nx_chem_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD19 Domain reach is graded by known-answer suites whose expected answers come from the field's own tools run outside the estate proposed
Work log	no log row names this rung yet

LN87 The Kaggle door: a static ELF entry that reads the competition data and writes a scored submission · cell WATCHING · gate NO-GATE-DECLARED

Contract	`kg_submit` · executor Organ · 3 u · stands on LB0
Definition of done	The notebook image is Python 3.12 with gcc and no Rust, Julia or wasm runtime [kaggle-docker-python-2026-09], so the sovereign entry is a static ELF the notebook executes: a CSV and parquet reader, the model in integer arithmetic, a submission writer, and a receipt carrying the public leaderboard score beside the competition's Python baseline; done-rule: one competition entered and scored, the arena's number on the receipt
Matrix cell	The Kaggle door: a static ELF entry that reads the competition data and writes a scored submission · `runtime/nx_kaggle_door.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_kaggle_door`; declare `nx_kaggle_door TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD21 An arena receipt carries the arena's own number beside ours: a leaderboard score, a benchmark pass count, a regulator's named obligation proposed
Work log	no log row names this rung yet

LN88 The TRACTOR arena: C to NishiLang translation graded by the DARPA benchmark's own tests · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tr_translate` · executor Organ · 8 u · stands on LN3, LN4
Definition of done	DARPA's TRACTOR benchmark grades automated C-to-Rust translation with its own tests [tractor-bench-2609-25121]; the exceed candidate is translation into a language whose safety ring is declared modes (--chkarith --optenforce --ptrprov --ownership) rather than an unsafe escape hatch, with the benchmark's harness run outside as the referee; done-rule: the benchmark's pass count printed beside the published Rust translators' counts, and every refusal of the safety ring named by rule
Matrix cell	The TRACTOR arena: C to NishiLang translation graded by the DARPA benchmark's own tests · `runtime/nx_c2nx.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_c2nx`; declare `nx_c2nx TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD21 An arena receipt carries the arena's own number beside ours: a leaderboard score, a benchmark pass count, a regulator's named obligation proposed
Work log	no log row names this rung yet

LN89 CRA conformance receipt: SBOM, vulnerability handling and reporting evidence carried by every shipped artifact · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cra_receipt` · executor Organ · 2 u · stands on LR3, LR5
Definition of done	The EU Cyber Resilience Act reporting obligation applies from 11 September 2026 [eu-cra-2026-09]; the content-addressed package lane (LR3) and the written spec (LR5) already carry the identity and the semantics, and this organ writes the receipt an artifact ships with: the closure's SBOM by content hash, the vulnerability-handling contact, the reporting path and the date each obligation applies; done-rule: a shipped artifact's receipt validates against the Act's named obligations and a receipt missing a field is refused by name
Matrix cell	CRA conformance receipt: SBOM, vulnerability handling and reporting evidence on every shipped artifact · `runtime/nx_cra_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_cra_lib`; declare `nx_cra_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD21 An arena receipt carries the arena's own number beside ours: a leaderboard score, a benchmark pass count, a regulator's named obligation proposed
Work log	no log row names this rung yet

LN90 Per-category standing on the scorecard: the domain-reach, door and arena categories each print their own WIN, LOSE, TIE and UNMEASURED line · cell LANDED · gate NO-GATE-DECLARED

Contract	`ls_category_lines` · executor Organ · 1 u · stands on LN67
Definition of done	nx_lang_scorecard counts every verdict under the @cat line it fell under and writes cat rows beside the score rows, so the crew reads the standing of one lane (Domain reach, Tooling ring, the safety ring) as one line instead of re-deriving it from 500 rows; the category count is derived from the board (no cap), and the gate proves a two-category board splits its counts exactly and a one-category board carries every row
Matrix cell	Per-category standing on the scorecard · `runtime/nx_lang_scorecard.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_scorecard`; declare `nx_lang_scorecard TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD22 A pointer parameter is non-null by type and the caller proves it; only a declared nullable pointer carries a null check at its use proposed
Work log	2026-09-26 land 2026-09-26 nx_lang_scorecard SHIPPED c5d885d825337ff61b08cae7a5fd88cfca7dd92054b32f8b0af8b55f8f5cd4d0 (nx_lang_scorecard_gate 41/41 with the category teeth; content ruler GREEN, behaviour DIFFERS by design because CATEGORY lines were added, adopt-gate APPROVED); category counts are sized from the board's own @cat lines and written as hash-prefixed cat rows the page reader skips by construction. FIRST RECEIPT with the three specialist columns and the Domain reach category: 14 rivals, 50 axes, 714 rows = win 226 + lose 212 + tie 212 + unmeasured 64, superior NO; per category Domain reach win 68 lose 47 tie 95 (210 rows), Sovereignty and determinism win 61 lose 1 tie 8, Memory safety win 12 lose 72 tie 14 (still the largest LOSE cluster), Tooling ring win 37 lose 41 tie 34; per specialist Julia 15W 17L 14T, R 18W 11L 17T, Lean 14W 21L 11T; the page's scorecard block re-derived rows=714 rivals=14 from the receipt on the same regen 2026-09-26 land nx_langcensus gains mode=<name> (forwarded to the compiler as --mode=<name> BEFORE the path) and root=<dir>, and its first gate nx_langcensus_gate (23/23: a planted root, the gate as the planted compiler, three runs, DELTA and the REGRESSION exit bite-proven); promoted 8c6eec67 after the one lost run (the sys_execve_clean identifier string) was read and named 2026-09-26 queue the checked-mode whole-population census is IN FLIGHT as job 1790462580 (nx_langcensus /volume1/homes/elderwesto/nishihost/nx_compile_x86.elf knowledge/status/langcensus_checked_20260926.rows 60000 mode=checked root=buildroot): rows append as each program is decided, so the file is a PREFIX until the job's envelope prints LANGCENSUS verdict=; read the envelope from _jobs/job_1790462580.out and journal the refusal histogram here as the measured distance to flipping the safety ring on by default (the 2026-09-03 default-build figure was 773 refusals) 2026-09-26 lesson the in-flight checked-mode census (job 1790462580) classifies correctly but its REASON column is void: under --mode= the driver prints an INFO line (nx_compile_x86: --mode= conf resolved at knowledge/lang_modes.conf) before any diagnostic, the census's marker list accepts the driver prefix as a diagnostic marker (added 2026-09-03 so driver refusals would not read as blank), and 974 of the first 975 ERR rows grouped under that line -- a histogram that names no cause; the OK/ERR/HANG classes and the refusal COUNT stay valid, the reasons do not; fixed at the root in nx_langcensus (an information line is skipped, never a reason), and a re-run under the fixed census is queued once the in-flight run publishes its envelope 2026-09-26 measure prefix of the in-flight checked-mode rows read 2026-09-26 while the job ran (the first 163,840 bytes of the rows file, a PREFIX by construction): programs=2982 ok=2007 err=975 hang=0 harness=0; the population is the whole runtime/ walk (about 13,790 programs on 2026-09-03), so the checked-mode refusal share of this prefix is roughly one third, against 773 refusals in the default build that day; read the envelope in _jobs/job_1790462580.out for the population figure 2026-09-27 measure checked-mode whole-population census COMPLETE 2026-09-26 (job 1790462580, nx_langcensus mode=checked root=buildroot, 60000 ms per program): files=22285 programs=15723 ok=6859 err=8864 hang=0 harness=0, partition RECONCILES, rows_written=1231788 at knowledge/status/langcensus_checked_20260926.rows; 564 permil of every top-level program refuses to build with chkarith, optenforce, ptrprov, ownership and sendcheck all ON, against 773 refusals in the default build of 2026-09-03 (a population of 13790 then, 15723 now) -- that is the measured distance to flipping the safety ring on by default, and it is a BASELINE (no judgement), not a regression 2026-09-27 queue the reason histogram of job 1790462580 is VOID (8864 of 8864 grouped under the driver's --mode= info line, the defect fixed in nx_langcensus e8eb491c); the re-run under the fixed census is job 1790471555 writing knowledge/status/langcensus_checked_20260926b.rows with the first rows as its BASELINE, so its envelope doubles as a determinism control (delta new_err=0 new_hang=0 fixed=0 expected) and its REASON lines are the per-cause worklist for the safety ring; journal that histogram here and on the sota memory-safety rows when it lands 2026-09-27 measure prefix of the corrected checked-mode census (job 1790471555, the first 1723 programs, a PREFIX by construction): ok=1407 err=315, and the reasons now name causes: 295 of 315 refusals are --optenforce (a dereference of a pointer the mode cannot prove non-null on its path, grouped by local name: ctx, c, lp, a, p, out, slot), chkarith=0 ptrprov=0 ownership=0 sendcheck=0 other=20; so the null-enforcement mode is the ring's dominant blocker on this prefix and its proof rules (which idioms count as a null check) are the first lever, read the job's REASON histogram when it completes before sizing the campaign 2026-09-27 measure corrected checked-mode census COMPLETE (job 1790471555, nx_langcensus e8eb491c, baseline = the first run's rows): files=22305 programs=15739 ok=6859 err=8880 hang=0 harness=0 RECONCILES, rows at knowledge/status/langcensus_checked_20260926b.rows; delta against the first run new_err=0 new_hang=0 fixed=0, so the census is deterministic and the 16 extra programs are files added to the tree between the runs; the reasons now name causes: --optenforce 8330 of 8817 counted refusals (the null-enforcement mode; the local 'ctx' alone 3603, then c 523, p 368, lp 316, out 287, fresh 278, b 247, h 232), --ownership 210, constant-arithmetic overflow 70 (chkarith's compile-time check), and REASON-TABLE FILLED at 512 distinct reasons so the histogram is a PREFIX of 8880 (63 uncounted); the null rule is 94 percent of the distance to the safety ring 2026-09-27 lesson the locals the null mode cannot prove are overwhelmingly PARAMETERS named by convention (ctx, c, p, lp, out, a, b, h, st, w, src, slot): the estate trusts internally (rule 12) and never null-checks a parameter, so a checker that treats every pointer parameter as maybe-null refuses the estate's own idiom more than 8000 times; the SOTA convention is the opposite default, a pointer parameter non-null BY TYPE with nullability declared where null can arise, which moves the proof to the call site and the fallible producer; landed as design LD22 and rung LN97 (contender on lt-typed-security), a compiler-lane change through the canaried toolchain door, not a threshold

LN91 The sensor door: a microcontroller-class lowering from the same source under the never-brick classifier · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dr_door_mcu` · executor Organ · 8 u · stands on LN75
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the native doors are x86-64 and RV64; the MCU lane has kernels, a fit gate and the Rule-26 brick classifier (nx_mcu_brick) but no compiler door, so the sensor in a field is not yet a target the language can name; done-rule: an RV32 or Cortex-M lowering declared as a door (LN75) builds the door-census fixture, runs it on the simulator with the same checksum as x86-64, and every persistent-state write is classified reversible or refused by the brick classifier; LispBM's users are the bar for what a sensor program grows into [lispbm-2609-23009]
Matrix cell	The sensor door: a microcontroller-class lowering from the same source under the never-brick classifier · `runtime/nx_door_lower_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_door_lower_lib`; declare `nx_door_lower_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD20 A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading proposed
Work log	no log row names this rung yet

LN92 The quantum door: a hybrid quantum-classical dialect with a sovereign statevector simulator as its first target · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dr_door_quantum` · executor Organ · 8 u · stands on LN75, LN76
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: a quantum target has no door and no refusal; September's frontier is hybrid and dynamic -- gates as first-class values in the IR [quantum-dynamic-ir-2609-01037], Python front ends compiled to CPU, GPU and FPGA back ends for real-time error correction [quantum-backline-2609-09270], purely unitary higher-order programs [granthi-2608-20443]; done-rule: a dialect declared as data lowers a QFT and a Grover fixture to a sovereign integer-deterministic statevector simulator whose amplitudes match the field's simulator run outside as the oracle, with resource counts printed per program
Matrix cell	The quantum door: a hybrid quantum-classical dialect with a sovereign statevector simulator as its first target · `runtime/nx_door_lower_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_door_lower_lib`; declare `nx_door_lower_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD20 A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading proposed
Work log	no log row names this rung yet

LN93 The photonic door: continuous-variable semantics as a dialect lowered to a CV simulator · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dr_door_photonic` · executor Organ · 8 u · stands on LN92
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: photonic hardware computes in continuous variables and the estate's op-layer hedge is a bet, not a door; the field now has a formal CV semantics and a Hoare logic [cvqc-verif-2607-17714]; done-rule: a CV dialect declared as data lowers a displacement-and-squeezing fixture to a sovereign CV simulator whose moments match the field's simulator run outside as the oracle, and a program the door cannot lower is refused by name
Matrix cell	The photonic door: continuous-variable semantics as a dialect lowered to a CV simulator · `runtime/nx_door_lower_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_door_lower_lib`; declare `nx_door_lower_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD20 A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading proposed
Work log	no log row names this rung yet

LN94 The cluster door: multi-node placement through the mapper with a transport in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mp_map_cluster` · executor Organ · 8 u · stands on LN73
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the mapper (LN73) places within one box; a supercomputer is many boxes and there is no transport in the language, so a cluster is a rewrite; done-rule: the mapper places tasks across nodes over a sovereign message transport, the door-census fixture prints the same checksum on one node and on N with the speedup printed, and placement never changes the result (the Legion invariant)
Matrix cell	The cluster door: multi-node placement through the mapper with a transport in the language · `runtime/nx_mapper_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mapper_lib`; declare `nx_mapper_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD20 A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading proposed
Work log	no log row names this rung yet

LN95 The door census: one known-answer fixture built through every declared door, one receipt · cell LANDED · gate NO-GATE-DECLARED

Contract	`dc_run_ladder` · executor Organ · 2 u · stands on LN75
Definition of done	The measurement organ for lt-any-hardware: reads the door ladder, builds the fixture through every door (x86-64, RV64, wasm32, wasm64, the MCU, GPU, quantum and photonic doors as they land), runs each on its simulator or host, and prints PASS, REFUSED-BY-NAME or ABSENT per door with the checksum; partition sums to the ladder; a door that silently degrades is a defect the census names; the doors category on the scorecard is written from this receipt and never by hand
Matrix cell	The door census: one known-answer fixture built through every declared door, one receipt · `runtime/nx_door_census_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_door_census_lib`; declare `nx_door_census_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD20 A door is claimed only by a known-answer fixture that prints the door's checksum, and the smallest door refuses by name rather than degrading proposed
Work log	2026-09-26 land nx_door_census_lib + nx_door_census + nx_door_census_gate shipped through nx_organ_ship (gate 27/27, neg-control bite-proven, recursion-guarded), promoted fed5ffdd, registered, _offc twin installed; the ladder is data at buildroot/knowledge/lang_doors.conf (9 doors: x86-64, wasm32, rv64, wasm64, mcu, gpu, quantum, photonic, cluster) 2026-09-26 measure first true ladder receipt 2026-09-26 (nx_door_census over runtime/nx_bounds_perf.nx): x86-64 PASS checksum=31447040000 through nx_compile_x86 then nxasm_x86_main then the built ELF run in place (3 of 3 stages); wasm32 REFUSED at stage 1 of 3, nx_compile_wat rc=3 with no arm in the WAT emitter for an opcode the fixture uses; rv64 REFUSED by name, ./nx_compile_rv64.elf is not on the host; wasm64, mcu, gpu, quantum, photonic and cluster ABSENT (declared with no lowering); doors=9 pass=1 refused=2 absent=6, partition sums, verdict MEASURED 2026-09-26 lesson two receipts before the true one were the instrument, not the doors: the merged stdout+stderr capture glued the compiler's one log line onto the .s and the ASSEMBLER refused it (fixed by tr_run_redirect for artifact stages: stdout is the product, stderr the tail), and the NAS mounts /tmp noexec so the built fixture read NX-EXEC-FAILED rc=127 (fixed by a scratch ladder that starts at buildroot/_build/door_census and prints the rung it took); a REFUSED door must be read as a claim about the pipeline until the plumbing is proven innocent 2026-09-26 queue the wasm32 door is the next lowering: read buildroot/_build/door_census/door_w32.wat.err for the opcode nx_compile_wat has no arm for on this fixture, add the arm or lower the construct, then the VM twin must echo the checksum before the door can read PASS; the rv64 driver is LN34's door; tr_run_redirect carries no deadline so a hanging compiler hangs the census at that stage (a deadline variant is owed) 2026-09-27 measure the wasm32 door's refusal, read from buildroot/_build/door_census/door_w32.wat.err: nx_wasm cannot lower IR opcode 29 in function fmt_putn_fd (the fixture's decimal printer); the backend has no arm for that opcode and refuses by name instead of emitting a comment that computes zero (its own header records that older silent form); the wasm32 door opens when that one arm lands in the WAT emitter and the VM twin echoes the checksum 2026-09-27 land nx_door_census v3 shipped through the full loop with a REVIEWED behaviour change (review file knowledge/status/harness/door-census-review-20260926.txt bound to the retained observation, evidence file beside it): artifact stages run through tr_run_redirect_to (a bounded redirect runner added to nx_tool_run, the incumbent watchdog composed, no polling interval invented), a stage that outlives the deadline is HANG (killed, named with the deadline; gate 34/34 with a planted hanging stage and a wall-clock tooth proving the kill), promoted d9093af6; the RV64 door is DECLARED on the ladder: nx_nxc (the original sovereign RV64 driver, promoted from its build fossil ea7ef711) then nx_emu_rv64_main (promoted 6a27e72b) 2026-09-27 measure ladder receipt 2026-09-26 run 6: x86-64 PASS checksum=31447040000; wasm32 REFUSED at stage 1 of 3 (nx_compile_wat: no arm for IR opcode 29 OP_ADDR_OF, the address of a stack array in fmt_putn_fd); rv64 REFUSED at stage 1 of 2 with the first stage NAMED: nx_nxc expands and compiles the whole closure to 184677 bytes of RV64 assembly and its assembler stops at pos 34814 (n_labels=121) on an atomic mnemonic with the .aqrl suffix -- nxasm_v2 (RV64I+M) does not carry the RV64A forms nx_riscv emits for OP_ATOMIC_* (LN34); 6 doors ABSENT; doors=9 pass=1 refused=2 hang=0 absent=6, partition sums, verdict MEASURED 2026-09-27 queue the two doors now have ONE named blocker each: wasm32 needs a shadow stack for address-taken and array allocas in the WAT backend (OP_ADDR_OF arm, frame allocas as real pointers, prologue and epilogue at the one exit label) and then a host write import so the checksum can surface in the VM twin; rv64 needs RV64A (lr, sc, amo* with aq and rl bits) in nxasm_v2 and, behind it, in nx_rv64_sim if the emulator lacks them 2026-09-27 land the RV64 door's assembler blocker is gone: nxasm_v2 carries RV64A (lr, sc, amoswap, amoadd, amoxor, amoand, amoor, amomin, amomax, amominu, amomaxu over .w and .d with the .aq, .rl and .aqrl bits) and FENCE (pred and succ over i o r w), encoded from the ISA manual's A extension; nx_nxc rebuilt with it assembles the fixture's whole 185,326-byte closure (stage 1 of the rv64 door PASSES on the staged driver) and is promoted 46d6f5cd; the emulator stage now answers exit 254 with no output, the next named blocker 2026-09-27 measure the staged WAT backend with the shadow stack (frame allocas as real pointers, OP_ADDR_OF as the slot's address, helpers built from block and br_table only) COMPILES the fixture (stage 1 PASS on the staged compiler) and the sovereign WAT compiler assembles the 24,552-byte module (stage 2 PASS); stage 3 is nx_wasm_vm_verify, which abstains (exit 3, NOT-A-RENDERER) on a plain program, so the browser door now needs a runner that calls main and a host write import so the checksum can surface -- the door row keeps its honest REFUSED until that runner exists 2026-09-27 measure THREE DOORS PASS THE SAME FIXTURE 2026-09-26 (nx_door_census run 8 on runtime/nx_door_probe.nx, checksum 686096800 computed outside the estate by CPython): x86-64 PASS (nx_compile_x86, nxasm_x86_main, run in place), wasm32 PASS (nx_compile_wat --host-write with the shadow stack, nx_wat_compiler, nx_wasm_run calling main on the VM twin with env.nx_write bound to the host's stdout: the checksum surfaced from a wasm module for the first time), rv64 PASS (nx_nxc with RV64A in its assembler, the RV64 emulator with fence, RV64A, mmap and a named step budget); doors=9 pass=3 refused=0 hang=0 absent=6, partition sums, verdict MEASURED; the six absent doors (wasm64, mcu, gpu, quantum, photonic, cluster) are the ladder's remaining distance 2026-09-27 land the browser door's pieces: nx_wasm.nx carries a shadow stack for address-taken and array allocas (frame slots as real pointers, OP_ADDR_OF as the slot's address, helpers built from block and br_table only, the stack pointer in a cell past the static data because neither the WAT compiler nor the VM twin carries globals, a module with no such alloca byte-identical, a shared-memory module with one REFUSED by name) and the host write door behind nx_compile_wat --host-write (env.nx_write, opt-in so shipped modules stay byte-identical); nx_wasm_vm binds env.nx_write to the host's stdout and stderr with bounds traps; nx_wasm_run <module> [export] runs an export on the VM twin and prints WASM-RUN export= rc= last; the RV64 door's pieces: nxasm_v2 RV64A + fence, nx_emu_rv64 fence, RV64A, mmap bump allocator, unknown syscalls answer -ENOSYS, nx_emu_rv64 <elf> [max_steps] with every non-exit outcome NAMED on stderr (the old exit 254 was the step budget as a bare byte); the door fixture is runtime/nx_door_probe.nx and the h2h bench fixture stays the speed fixture 2026-09-27 lesson a door blocked at its last stage by a bare status byte cost a diagnosis the emulator could have printed: exit 254 was the step budget, not a fault, and the fixture (the h2h bench, billions of instructions) was the wrong program to ask an interpreter to run inside a 60 s deadline; a door fixture measures that the door carries a program end to end, the bench fixture measures speed, and the two must not share a row; and the estate ALREADY held the RV64 driver (nx_nxc, built and never promoted) and the VM's host-import dispatch (a sibling landed it the same day for the device client) -- ★★★★★★ "I DIDN'T KNOW IT EXISTED" IS A RETRIEVAL FAILURE, NOT A DISCOVERY, paid twice in one leg 2026-09-27 measure the promoted WAT compiler (1ea9e8f8) against its referees, 2026-09-26: nx_wat_refuse_gate 14/14 GREEN (LN13a intact: a function address still refuses as IR opcode 144) once its subject default was a root ladder instead of a bare _build/ path that does not exist from the serving root (fixed and promoted 038a9015; it had read PRECONDITION MISSING with six dependent FAILs for a reason unrelated to any compiler); nx_wasm_threads_gate 33/37 RED, ADJUDICATED PRE-EXISTING: nx_behaveprobe live-vs-prev on its own fixtures fx_shared.nx and fx_plain.nx reads IDENTICAL (11507 and 1332 bytes, first_diff_off=-1, STRONG) and the roster journal shows the same 33/37 on its last eight rostered runs before this promote -- its four failing teeth are the shared-memory limits declaration (min 1 max 2) and belong to the GE30 build-lane memory work, named here for that lane; nx_world_recipe_gate 18/18 GREEN; nx_wasm_run_gate 16/16 GREEN (the new runner, end to end on the promoted toolchain); nx_game_page_artifact_gate exits 2 (usage) under a bare gate_run, unrelated 2026-09-27 queue the ladder's remaining distance is the six ABSENT doors -- wasm64 (LN35), mcu (LN91), gpu (LN75), quantum (LN92), photonic (LN93), cluster (LN94) -- each opens by adding its stages to buildroot/knowledge/lang_doors.conf and reading PASS on nx_door_probe; the browser HOST must bind env.nx_write (console) in the page loaders before a --host-write module can run in a page (the VM twin binds it today); nx_door_census's CLI default fixture is being moved to nx_door_probe so the roster beat needs no argv; the shared-memory shadow stack (a per-thread pointer) is the named refusal for threaded modules with address-taken allocas 2026-09-27 land 2026-09-27 nx_door_census SHIPPED c2336215: the CLI default fixture is runtime/nx_door_probe.nx, so the bare run reads x86-64 PASS, wasm32 PASS, rv64 PASS, 6 ABSENT, verdict MEASURED; shipped through the loss protocol (2 lost runs, both the old default path literals, allow_loss_v1) and the behaviour-review protocol (review sha eec6c075, retained observation dc0dc236); gate 34/34 GREEN on the NAS; _offc twin installed; /compare/lang republished (published=3 fails=0 forkfresh=1), nx_page_verify GREEN, nx_compare_rank lang BARFRESH 11/11 FRESH and LADDER 114/114 LADDERED 2026-09-27 measure 2026-09-27 nx_compare_rank lang critical path: #1 LN13 capturing closures at 2.0, #2 LN70 serial elision, #3 LN69 mode fit UNMAPPED; 20 of the 33 ranked rungs read DARK-CONTRACT, which for an unbuilt symbol on an existing organ file is the ruler's honest reading (sd_present 0 = organ read, symbol not declared), not a naming defect; 3 rungs UNMAPPED (LN69, LN46, LN61: no matrix row carries the symbol); TREATMENT rows=0 undeclared=114 verdict NO-TREATMENT (EC49 three-step treatment not yet declared on this board) 2026-09-27 queue the six ABSENT doors stay ABSENT by name in the census (wasm64 LN35 is the nearest: nx_wasm.nx already centralises the i32 narrowing behind wat_mem64_on; the WAT compiler's limits encoding and the VM's i64 addressing are the missing stages); the mechanism owed for the darkness axis is unchanged: a matrix row per rung symbol (LN69, LN46, LN61) and treat rows for the rungs that already have MCP, API, primitive, workflow and agent evidence 2026-09-27 measure 2026-09-27 the door ladder reads 4 of 9 doors PASS on one fixture (x86-64, wasm32, rv64, wasm64), up from 3 the same morning; every stage forks an estate binary built by nx_cc and nxasm_x86 (the receipts say no gcc), the only outside parties are oracles: CPython computed the fixture checksum once and a browser is the queued witness for the 4 GiB crossing

LN96 The arXiv digest: a mirrored listing read as rows by an estate organ, never by a seat's script · cell LANDED · gate NO-GATE-DECLARED

Contract	`ad_digest` · executor Organ · 1 u · stands on LN65
Definition of done	nx_arxiv_digest_lib ad_digest turns a mirrored Atom listing into entry rows (published, id, squashed title, categories, bounded abstract head) with an envelope naming entries, newest and oldest dates and every absence; nx_arxiv_digest is the CLI and nx_arxiv_digest_gate its referee (multi-line title, entity, pipe-in-field, missing summary, scrambled dates, cap-cut counted, non-feed UNREADABLE bite-proven); it composes the census organ's role rather than claiming completeness (population= is UNJUDGED on every envelope); built 2026-09-26 because this seat digested three listings with a laptop script, the exact add-on LN80 counts
Matrix cell	The arXiv digest: a mirrored listing read as rows by an estate organ · `runtime/nx_arxiv_digest_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_arxiv_digest_lib`; declare `nx_arxiv_digest_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-26 land 2026-09-26 nx_arxiv_digest SHIPPED through nx_organ_ship (sha 834c18ec4d7be7240a072d444a49c493cd7d0c2961b450adbc5bdeebe7bfea63, promoted, _offc twin installed, registered callable) with its gate rebuilt in the loop and then shipped itself (nx_arxiv_digest_gate sha 9f7734a6b9d10e57e8bbec416762d938915c28f86fe9a16d4e8a8288578cc1e9, 27/27 on the NAS build and 29/29 through the ship loop where the real listing is reachable, the non-feed neg-control bite-proven, registered, on the gate roster and on lang.gates); first live run over the pinned September cs.PL listing through the sovereign surface: entries=100 newest=2026-09-24 oldest=2026-08-27 rows_bytes=28006 at abstract_cap 160, verdict DIGESTED, population left to nx_arxiv_census by construction

LN97 Pointer parameters are non-null by type; nullability is declared where null can arise and checked there · cell WATCHING · gate NO-GATE-DECLARED

Contract	`opt_param_nonnull` · executor runtime/nx_option_enforce.nx · 30 u · stands on LN2, LN90
Definition of done	The corrected checked-mode census (2026-09-26) says 8330 of 8817 counted refusals under the safety ring are the null-enforcement mode refusing a dereference of a pointer it cannot prove non-null on its path, and the locals it names (ctx 3603, c, p, lp, out, a, b, h, st, w, src, slot) are PARAMETERS the estate never null-checks because it trusts internally (rule 12); the SOTA default (Kotlin, Swift, TypeScript strict, Rust references) is the inverse: a pointer parameter is non-null BY TYPE, the caller proves it at the call site, and only a declared nullable pointer (a fallible producer's result: a lookup, a parse, a syscall that may return zero) needs the check at its use; the rung flips the mode's proof rule to that convention, keeps the current rule for declared-nullable pointers, and is graded by the census: the --optenforce refusal count over the whole population, the residue read row by row; a toolchain change through the canaried door (nx_cc_equiv_gate 10/10, self-host, canary), never a loosened checker
Matrix cell	Null enforcement: pointer parameters non-null by type, nullability declared · `runtime/nx_option_enforce.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_option_enforce`; declare `nx_option_enforce TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD22 A pointer parameter is non-null by type and the caller proves it; only a declared nullable pointer carries a null check at its use proposed
Work log	no log row names this rung yet

LN19a Packed reductions on the RV64 and wasm doors: the same OP_I64SUM lowered per door · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`x86ctx_emit_i64sum` · executor runtime/nx_riscv.nx · 3 u · stands on LN19, LN95
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: only the x86 backend lowers OP_I64SUM, so opt_vec_reduce is switched on for the native door alone (nx_compile_x86 sets the lane count; nx_nxc and nx_compile_wat leave it 0 and never meet the opcode); done-rule: nx_riscv lowers the op to a scalar loop and nx_wasm to i64x2.add over v128 loads, each driver switches the pass on, and the door census fixture plus nx_vecred_probe print the same checksums through all three doors
Matrix cell	NO-MATRIX-ROW — no matrix row carries `x86ctx_emit_i64sum`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN19b The AVX2 door for the reduction: four lanes per accumulator chosen by measured CPUID, a ladder row and never a constant · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`x86ctx_emit_i64sum_avx2` · executor runtime/nx_x86_64_ctx.nx · 3 u · stands on LN19
Definition of done	the SSE2 lowering needs no host check because SSE2 is x86-64 itself; the four-lane form (vpaddq over ymm) doubles the lane width where the host measures AVX2 (nx_cpuid) and must never be emitted where it does not, so the width is a row in knowledge/tier_ladder.conf read for the build host or dispatched at run time; the gate proves the SSE2 form is byte-identical on a host without AVX2
Matrix cell	NO-MATRIX-ROW — no matrix row carries `x86ctx_emit_i64sum_avx2`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN19c The packed sum by name: __i64_sum(p, n) as a surface builtin lowered to OP_I64SUM · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ir_emit_i64sum` · executor runtime/nx_parse.nx · 1 u · stands on LN19
Definition of done	a program that knows its loop is a reduction can ask for the packed form directly the way __i16_dot does, so a kernel author never depends on the matcher recognising a shape; done-rule: the builtin parses like __i16_dot (nx_parse.nx), the KAT sums every tail length 0..17 through it, and a door without the lowering refuses by name
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ir_emit_i64sum`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN19d The sibling reductions: product, min, max, xor and i32 elements through the one matcher · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`opt_vec_reduce_kind` · executor runtime/nx_opt.nx · 3 u · stands on LN19
Definition of done	the matcher recognises one accumulate shape (i64 add); the same skeleton with the operator as data covers xor, product and the i32 element size directly, and min and max through a compare-and-select sequence (SSE2 has no packed 64-bit min or max), each with its own known-answer fixture; done-rule: nx_vecred_probe grows one case per kind and the gate reads a VECRED kind= field per rewrite
Matrix cell	NO-MATRIX-ROW — no matrix row carries `opt_vec_reduce_kind`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN98 The regression corpus: every compiler defect becomes a test program with directives, run by one sovereign harness · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tr_lit_run` · executor Organ · 4 u · stands on LN95
Definition of done	BEST IN CLASS: LLVM tests its compiler on the regression corpus under llvm/test (sized by its community in the tens of thousands of files, unmeasured here), each file a program carrying RUN lines and FileCheck patterns, run by lit, under the rule that a bugfix and a feature each add a test [llvm-testing-guide]; Kotlin's K2 is tested on an annotated corpus of programs with embedded directives and golden files reused across every target [kotlin-k2-story]; the estate has fixtures (nx_ccfold_repro.nx in the equivalence KAT, the door and reduction probes) but no corpus format, no directive language and no runner. Done-rule: nx_lit_lib reads a test program's directive lines (the door to build with, the mode flags, the expected exit, the expected stdout, a refusal that must be named), nx_lit runs a directory of them through the live and the candidate compilers and prints a partition (pass, fail, refused-as-expected, unreadable) that sums; every open compiler defect row gains one test program; the gate plants a test whose expectation is wrong and proves it fails, and one with a malformed directive and proves it is named
Matrix cell	Regression corpus with directives, the lit-class runner · `runtime/nx_lit.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lit`; declare `nx_lit TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-28 queue M9 declared 2026-09-28 from six mirrored sources (the LLVM testing and test-suite guides, the Fujitsu suite README, the cpplinks compilers index, the K2 story, the August 2026 arXiv listing) and the operator's order; standing today: every class ABSENT on the matrix, the estate's only suite-class instruments being the 10-row equivalence net, the self-host gauntlet, the door census, the gates and their bites

LN99 The golden-dump harness: an IR or assembly dump matched by a sovereign pattern checker, per optimizer pass · cell LANDED · gate NO-GATE-DECLARED

Contract	`tr_dumpcheck` · executor Organ · 3 u · stands on LN98
Definition of done	LLVM's FileCheck matches an IR or asm dump against patterns embedded in the test (CHECK, CHECK-NEXT, CHECK-NOT) so a pass is tested by what it emits, not only by what the program prints [llvm-testing-guide]; the estate's --ir-dump prints post-opt IR and the VECRED and BCK-ELIDE lines narrate passes, but nothing matches them. Done-rule: nx_dumpcheck reads CHECK, CHECK-NEXT and CHECK-NOT lines from a test program and matches them against the compiler's stderr and the emitted assembly in order; the reduction, the elision and the closure lowerings each gain a dump test; the gate plants a CHECK-NOT that must fire and a CHECK that must fail
Matrix cell	Golden-dump pattern checking per pass, the FileCheck class · `runtime/nx_dumpcheck.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_dumpcheck`; declare `nx_dumpcheck TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land THE GOLDEN-DUMP CHECKER IS LIVE ON THE NAS. nx_dumpcheck (func tr_dumpcheck) b3f7e6cf (41050 B) and nx_dumpcheck_gate ad9d8000 (186154 B) are promoted and registered; the library, door and gate sources are in buildroot/runtime and the three dump tests (reduction, elision, closure) in buildroot/knowledge/littests. The gate read 179 of 179 GREEN on the NAS with the NAS compiler (buildroot/_build/nx_compile_x86.sov.elf, taken from its ladder), which settles the one thing the laptop could not: the goldens pin register names read off laptop compiler builds and had never been judged against the NAS compiler. Before that an independent verifier confirmed the repaired rung on the laptop: gate GREEN on both mandated runs, 240 concurrent runs with none RED, GREEN to SKIP and never to RED when the working directory lacks the tree, and no verdict ever computed from an unguarded compile 2026-10-04 measure ONE SILENT HOLE THE VERIFIER FOUND WAS CLOSED BEFORE THE SHIP. A test file saved with a UTF-8 byte-order mark lost its line-1 directive without a trace: a violated absence on line 1 read verdict=NONE and exit 0 where the same file without the mark read RED. dck_named now steps over the mark, and four teeth hold it (the marked test keeps its first-line directive, matches what its unmarked twin matches, and a line-1 absence still fires behind the mark, with a fixture tooth that the unmarked twin is RED). Planting the old behaviour turned exactly three of them RED and left the fixture teeth green; the library was restored byte-identical (32bc022e). Two of 15094 sources in the laptop tree start with the mark; no lit test does today 2026-10-04 queue LEFT OPEN FROM THE VERIFIER'S REPORT, NONE OF THEM ABLE TO CHANGE A VERDICT TODAY. (1) No tooth holds the canonical form's rule for a trailing blank: a mutant that kept one read 174 of 174. (2) Two header rules have no tooth (a missed positive blocks a later NEXT; a NEXT past the last dump line is refused by name). (3) Two door teeth (the CHECK-ERR run and the empty-dump run) compare the door's line with the library's own rendering. (4) The dump tests are named dump_*.nx, so the lit runner counts them and does not run them; they run through this gate. (5) The gate is not yet on the gate roster and has no organ_gate.conf row. (6) On the laptop the compiler ladder's first rung is a September fossil, so a bare run there reads RED 159 of 166; the gate says so in a SUBJECT-NOTE

LN100 The random program generator: well-defined NishiLang programs from a seed, with a checksum, for differential testing across compilers and doors · cell LANDED · gate NO-GATE-DECLARED

Contract	`pg_generate` · executor Organ · 6 u · stands on LN95, LN98
Definition of done	Csmith and YARPGen generate random programs free of undefined behaviour and compare compilers on their output, the class the field's index names [cpplinks-compilers]; the 2026 generators target IR dialects (MLIR-Smith) and cross-language compilers (CrossLangFuzzer), and CLIR fuzzes Cranelift by liveness-driven structure [arxiv-compiler-testing-2026-08]. NishiLang has no undefined arithmetic (i64 wraps, arrays are checked), so a generator that respects types and bounds by construction yields programs whose own output is the oracle. Done-rule: nx_progen emits a program from a seed (integer arithmetic, loops, fixed arrays, calls, closures, the reduction shape) that prints a checksum; nx_progen_diff builds N seeds through the live and the candidate compilers and through every door and reports a partition (agree, disagree, refused) that sums, appending each seed's verdict as it is decided. THE SEED TARGET IS DERIVED, NEVER TYPED (retracted 2026-09-28: a first cut said 10000): with zero disagreements over n seeds the per-program miscompile rate is bounded below 3/n at 95 percent confidence (the rule of three [rule-of-three]), so the comparator reads the population the candidate will compile (every .nx source under the runtime directories, counted at run time) and sets n = 3 x population, the count at which the expected number of miscompiled programs in the estate stays below one; it prints target, done and standing as a partition, and the conf row that holds the multiplier carries its calibration
Matrix cell	Random well-defined program generation for differential testing, the Csmith class · `runtime/nx_progen_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_progen_lib`; declare `nx_progen_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD27 A test budget is DERIVED from the population it protects and a cited confidence bound, printed beside its inputs on every run, never typed adopted
Work log	2026-09-28 land FIRST SLICE SHIPPED 2026-09-28, the first instrument of M9: nx_progen_lib (pg_generate: a well-defined NishiLang program from a seed -- i64 arithmetic that wraps, array indices masked into a power-of-two length, divisors (x & 15) + 1, counted loops to constant bounds, no recursion, helper functions, by-value closures and the LN19 reduction shape, every value folded into one checksum; self-contained with its own write syscall, number printer and anonymous mapping so it compiles from any directory and any door; a planted-mutation mode flips one constant), nx_progen (the CLI), nx_progen_diff_lib + nx_progen_diff (a=<cc> b=<cc> seeds= first= stmts= flag= bflag= mutate= ledger=: builds every seed through both compilers, assembles with the one assembler, runs both, compares bytes and exit codes, one ledger row per seed as decided, the partition last: agree disagree refused-a refused-b asmfail runfail-a runfail-b), nx_progen_gate 18/18 GREEN on the NAS (ba4270b9) and the laptop with the bite proven (the mutated twin reads DISAGREE on 4 of 4 seeds while the reduction switch-off reads AGREE on 12 of 12). Promoted nx_progen f1cbfaa1, nx_progen_diff 9e802737, registered on the MCP surface 2026-09-28 measure CROSS-GENERATION DIFFERENTIAL on the NAS 2026-09-28: the banked previous build lane (nx_cc_sovereign.elf.bank-20260928b, the LN13c toolchain) against the promoted LN19 toolchain, 40 seeds from 200 under --bckelide: agree=40 disagree=0 refused=0 runfail=0, partition SUMS, verdict GREEN (ledger /tmp/ln100_xgen.ledger); the laptop's old _offc toolchain refuses every seed by name (REFUSED-A, it predates capturing closures), which is the comparator naming a generation gap rather than hiding it 2026-09-28 queue the 10000-seed bar per candidate is unmeasured (40 today); the door mode (the same seed through rv64 and wasm) waits on LN19a and the door census; shape weights stay uniform until LN104 mines the bug corpora; the checked mode needs its own comparator (both sides must trap at the same statement); a disagreement has no reducer until LN106 2026-09-28 retract THE 10000-SEED BAR IS RETRACTED 2026-09-28 (operator: isnt 10k a magic number): a typed count is a magic number, so the queue row of 1790608600 that named it is superseded by this row; the seed target is now DERIVED at run time by nx_progen_diff as numerator x population, where the rule of three [rule-of-three] says zero disagreements over n seeds bound the per-program miscompile rate below 3/n at 95 percent, so 3 x population keeps the expected number of miscompiled programs in the estate below one; the numerator, its confidence and the population dirs are rows of knowledge/progen.conf beside their calibration, the population is counted from the tree by one getdents64 loop per directory to exhaustion and deduplicated by basename (the two build trees hold the same names), and every generator shape knob (stmts, vars, funcs, arr, depth, trip_max) is a FIXTURE-CLASS conf row pending the LN104 mined distributions; a conf the generator cannot run on (a non-numeric row, a zero divisor, an array length that is not a power of two) is refused BY NAME and nothing runs 2026-09-28 measure DERIVED TARGET MEASURED 2026-09-28 on the laptop tree: population=22132 distinct .nx basenames over the 4 conf dirs (43098 entries before dedupe, 0 absent), numerator 3 at 950 permil, target_seeds=66396, standing NO-LEDGER (the standing run has not been started; the comparator with no seeds= continues a ledger toward the target from one past its highest seed); nx_progen_gate 43/43 GREEN on the laptop against the LN19 compiler with 18 new teeth (the fixture conf applies its knobs, a non-power-of-two arr and a non-numeric stmts are refused BY NAME with the value left at the bootstrap, an absent conf leaves the bootstrap, a fixture population of 7 entries over two dirs plus one absent dir reads 6 distinct with the absent dir named, the target reads 3 x 6, the ledger census counts only mutate_b=0 rows and takes the max seed over every row, a zero-seed run is never green by vacuity); NAS numbers on the next measure row after the NAS build 2026-09-28 measure DERIVED TARGET MEASURED ON THE NAS 2026-09-28: population=22497 distinct .nx basenames over the 4 conf dirs (22550 entries before dedupe, 0 absent; the NAS build tree and its twin hold near-identical name sets, so dedupe by basename is what keeps the count honest), numerator 3 at 950 permil, target_seeds=67491 (the laptop tree reads 22132 and 66396: the population is a property of the host that runs the comparator, printed on every run, never carried between hosts); nx_progen_gate 43/43 GREEN on the NAS by /api/gate_run (path FAST, subject buildroot/_build/nx_compile_x86.sov.elf by ladder; the live conf resolved at knowledge/progen.conf, the fixture conf, the two refusals by name, the population and ledger teeth, the 12-seed switch control and the 4-seed planted-mutation bite all green); promoted nx_progen_gate 4bd42e64, nx_progen_diff e1282c3a, nx_progen 206d4929 with _offc twins installed; knowledge/progen.conf landed at both roots; the standing ledger has 0 rows (standing NO-LEDGER) and starts with the next row 2026-09-28 measure THE BEAT SLICE SHIPPED 2026-09-28 (the standing run is a beat, not a seat): nx_progen_diff takes interval_s=<beat seconds> and derives its own budget as the interval minus one worst-case seed (six bounded runs x the 120 s run timeout = 720 s, so a 30-minute beat runs seeds for 18 minutes and starts none past that; a 10-minute beat is refused by name as shorter than one worst-case seed), prints PROGEN-DIFF-SLICE interval_s= budget_ms= elapsed_ms= seeds_planned= seeds_run= stopped=BUDGET-or-DONE, and judges the partition over the seeds actually run; nx_progen_gate 45/45 GREEN on the NAS (two new teeth: the budget reads 18 minutes for a 30-minute beat in an independent unit, the short beat is refused) and the laptop; promoted nx_progen_gate 1d244b0a and nx_progen_diff d4b2fd62 with _offc twins; the NAS population re-read on this run is 22672 (68016 seeds), up from 22497 an hour earlier because other lanes landed sources -- the target follows the tree and is re-derived on every beat; eco graph and import census refreshed (22787 nodes, asof 1790637268) so LN100 leaves LIB-UNCENSUSED on the next publish 2026-09-28 queue THE STANDING RUN IS DECLARED AS A CLOCK ROW 2026-09-28: progendiff every 1800 s = nx_progen_diff.elf a=nx_compile_x86.elf b=nx_compile_x86.elf interval_s=1800 ledger=knowledge/status/progen_x86_live.ledger flag=--bckelide bflag=--no-vecred srcdir=/tmp/progen_live execdir=buildroot/_build/progen_live (revision 221, DESIRED_COMMITTED; the scheduler folds it live at its next window init, about half an hour); every beat continues the ledger from one past its highest seed for at most 18 minutes, re-derives the target from the tree, and becomes a no-op reading AT-TARGET once the ledger holds numerator x population agreeing seeds; the witness that the beat fires is the ledger itself (ledger_rows and max_seed rising beat over beat, read by nx_progen_diff seeds=0), never the row's declaration; a DISAGREE row is a vectorizer miscompile with its seed as the reproducer and has no reducer until LN106; the door mode (the same seed through rv64 and wasm) still waits on LN19a, and the interval on the row and the interval_s in its argv are the same number in two fields of one row by construction of the clock grammar, named here so a later edit moves both 2026-09-28 lesson A CLOCK ROW WITHOUT AN EXECUTABLE BINDING IS SCHEDULED AND STILL NEVER FIRES: nx_clockjob put landed progendiff on both planes (LIVE scheduled=1) with executable_binding=UNBOUND schedule_state=WAITING_AUTHORITY authority_reason=EXPECTED_EXECUTABLE_MISSING, so the declaration read as live while the dispatcher had no authority to run it; the second half is nx_clockjob bind <name> <revision> <interval> <sha256 of the promoted elf> <absolute command> (done 2026-09-28: revision 222, expected sha d4b2fd62 = the promoted nx_progen_diff.elf, schedule_state=ELIGIBLE authority_reason=BOUND_CONTRACT, next_due 1790639211), and every re-promote of nx_progen_diff must re-bind the row to the new digest or the beat stops with the binding as its reason; the witness stays the ledger (rows and max_seed rising), read by nx_progen_diff seeds=0 or nx_clockjob get progendiff execution_proven 2026-09-29 measure THE /tmp OUTAGE OF 2026-09-29 WAS THIS ROW'S SCRATCH: nx_dirbytes (new census organ promoted 054baba3: allocated bytes by top-level entry and by name family, symlinks counted never followed, two counters of one population reconciled) read /tmp/progen_live at 7.8 GB in 236,721 files, three per seed, never deleted once a seed was judged; /tmp stood at 1000 permil with 0 B free, so every /api/build capture and every nx_job_run output under /tmp came back empty, and from seed 37,800 every generated program was written as 0 bytes (s53707.nx) and the A-side compile refused it: the 15,906 ledger rows for seeds 37,800-53,706 are REFUSED-A for programs that were never written, not compiler findings (debt 1790667949 by W19, which also stopped the row; 1790674394 carries the umbrella and the build-capture residual) 2026-09-29 land THE DISK IS NOT THE COMPILER, PROMOTED 2026-09-29: nx_progen_diff 68587c96 (131,664 B) and nx_progen_gate 5d32bedc (161,256 B, 49/49 GREEN, registered the same hour, _offc twins installed). One naming (pd_seed_path, eight kinds) is shared by the writer and the reaper so they cannot disagree; a source write that lands short is IOFAIL (verdict 7), never REFUSED-A; a compile refusal while the source filesystem holds less room than the larger of the program and the largest agreeing seed's measured footprint is IOFAIL; an agreeing seed's scratch is unlinked the moment its row is in the ledger (keep=1 retains it) and every other verdict keeps its files as its reproducer; the loop stops before a seed when the room is at or under the measured footprint and on the first IOFAIL (stopped=DISK). nx_contentdiff live to staged lost 0 runs for both (differ gained 26, gate gained 17). The new reap verb (nx_progen_diff reap) reaped the backlog from the ledger: rows=53706 reaped_seeds=37798 kept_rows=15908 files_unlinked=264586 partition=SUMS; /tmp 1000 -> 587 permil with 7.8 GB free, /tmp/progen_live 7.8 GB -> 126,976 B; nx_progen_reap_gate fcb810de 22/22 GREEN plants all eight kinds across seven verdicts and a bystander file 2026-09-29 retract A FIRST IOFAIL RULE WAS REFUTED BEFORE IT SHIPPED: an empty compiler error capture plus too little room was to mean the disk, but s39735_a.err, from a compile the full disk killed, held 4,340 B of the compiler's own status lines (crash-guard, dce, vecred, BCK-ELIDE), so an error capture is no evidence either way; the shipped rule is room against need only, and an IOFAIL seed keeps its files for inspection 2026-09-29 lesson A DIFFERENTIAL TESTER THAT CANNOT TELL ITS DISK FROM ITS COMPILER FILES THE DISK AS COMPILER FINDINGS -- 15,906 of them here: the write result was never checked, so a full tmpfs produced empty programs and the A-side refusal of an empty file became the verdict; the check sits at the write (bytes written against bytes asked), the refusal is judged against the room the program needed, and the scratch a judged seed no longer needs leaves with its row, or the tester's own evidence becomes the next outage 2026-09-29 queue progendiff STAYS STOPPED FOR ITS OWNERS (W19 stopped it at revision 222 -> 259, OWNER_STOPPED): the leak half of 1790667949 is closed in the path, but the serial-dispatcher hog 1790666328 (the row holds the one clock dispatcher up to 900 s of every 1800 s) is untouched and is the clock owner's and this lane's call. The recipe in 1790667949 binds the OLD digest d4b2fd62 and would now refuse; for the promoted binary it is nx_clockjob reactivate-bound progendiff 259 1800 68587c9651019016633829050442ca862263f575a2c953c371e2c9eb1877009a plus the unchanged absolute command. Owed before a long unattended run: the 15,906 false REFUSED-A rows are re-run or marked by the ledger's owner, and the remedy's second item (stop after a run of identical non-disk refusals, e.g. a broken A compiler, whose reproducers are kept by design and would refill /tmp at the seed rate until stopped=DISK) is not built -- IOFAIL covers the disk cause only; its bound is derived, the run length the ledger's own per-verdict rate makes implausible over the population, never a typed count 2026-10-04 land THE THREE FOLLOW-UPS THIS LANE OWED ON THE DIFFERENTIAL GENERATOR ARE LIVE, WITH TWO FIXES AND ONE ADDITION MADE AT REVIEW. Promoted nx_progen_diff e81bcbfc (234152 B), nx_progen_gate f6c47f9c (264496 B), nx_progen_reap_gate e68b99d3 (268536 B); NAS gates 74 of 74 (real compiler) and 139 of 139. What they add: a seed is judged by its LAST ledger row and requeue=<VERDICT> re-runs exactly the seeds whose last row carries it (rows are appended, never rewritten); a slice stops after an implausible run of identical refusals, the run length derived from the ledger's own rate; detach=<log> lets the dispatched process return at once while the slice runs under a lease keyed on the ledger. An independent verifier confirmed the build. At review: (1) the lease read any failure to look at the holder's process as a dead holder, the unsafe direction for a mutex; now only the kernel saying the process is gone counts, and could-not-look reads BUSY (pd_alive_of, eight known answers; the old rule planted fails exactly three). (2) The compiler gate's executables directory was a path relative to the serving root, so the build lane, which starts a gate in buildroot, read every seed as an assembly failure: RED 61 of 74 for a reason that had nothing to do with the generator; it now finds the directory on a ladder and names a missing one as a missing precondition. (3) A detached slice's exit code reaches nobody, so each slice now rewrites a gauge stamp beside the ledger and this board renders it. The promote guard read 23 permil capability loss: seven lost strings, each read (two arena-refusal sentences reworded in the shared syscall library, three verdict literals now composed from a key and a name, two retired function names) 2026-10-04 measure THE REPAIR OF THE 15906 FALSE REFUSALS IS RUNNING AND THE ROW IS BACK. The first requeue slice (REFUSED-A, seeds 37800 to 53706) was started detached through the estate's launcher: the launcher returned in 1 ms with the slice's pid, and forty seconds later the ledger's newest rows were seeds 37865 and 37866, both AGREE, so the programs the full disk never wrote now compile, run and agree, at about 1.6 seeds a second. The clock row progendiff is reactivated (revision 277) as the standing fresh run, detached, bound to the new executable; it finds the lease busy while a repair slice runs and continues by itself afterwards. /tmp read 613 permil used with 7.3 GB free before the run 2026-10-04 measure THE FIRST REPAIR SLICE ENDED THE WAY THE DESIGN SAYS, AND ITS OWN LINES ARE THE RECEIPT. PROGEN-DIFF-SLICE interval_s=1800 budget_ms=1080000 elapsed_ms=1080157 seeds_planned=15906 seeds_run=2811 stopped=BUDGET; PROGEN-DIFF seeds=2811 agree=2811 disagree=0; the lease read RELEASED; PROGEN-DIFF-STAMP gauge=0 axes_known=1 axes_total=1 cadence_s=1800; PROGEN-DIFF-LEDGER rows=56517 distinct_seeds=53706 superseded=2811 agree=40609 disagree=0 refused_a=13095 asmfail=2 sum=53706 partition=SUMS; PROGEN-DIFF-REQUEUE selected=15906 rerun=2811 skipped=1 left=13095. That is 2.6 seeds a second. The remaining 13095 are running as one detached slice with no beat budget (pid 25643, about 85 minutes at that rate), and the clock's fresh slice reads the lease busy until it ends. The two ASMFAIL seeds are 37799 and 39735: the first is the seed the disk filled on and the second sits inside the run of false refusals, so both are disk artefacts and not findings; the REFUSED-A requeue skipped the second by design (its last row is not REFUSED-A), and requeue=ASMFAIL from=37799 to=39735 repairs both once the lease is free

LN101 The conformance corpus: one test program per specification clause, generated from the language specification · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ls_clause_tests` · executor Organ · 5 u · stands on LN98
Definition of done	The Fujitsu suite organises its C, C++ and Fortran programs with reference outputs by language feature and is being folded into the LLVM test-suite [fujitsu-cts-readme]; the estate's nx_langspec declares the language but no corpus maps clauses to programs. Done-rule: every clause of the specification carries at least one test program with its expected output, the harness of LN98 runs the corpus through every door, and the coverage (clauses with a test over clauses) is printed as a partition, never a percentage without a denominator
Matrix cell	Conformance corpus per specification clause · `runtime/nx_langspec.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langspec`; declare `nx_langspec TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN102 The performance test-suite: many whole programs with reference outputs, timed and tracked per compiler generation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tr_perf_suite` · executor Organ · 5 u · stands on LN23
Definition of done	The LLVM test-suite is whole programs (SingleSource, MultiSource, MicroBenchmarks, External; 474 rows in the guide's own run) with reference output hashes, compile-time and code-size metrics, timed by timeit and tracked over versions by LNT [llvm-testsuite-guide]; the estate's head-to-head receipt is one workload. Done-rule: the receipt organ takes a directory of programs, each with its reference output, and writes one arm row per program per compiler with min and median, code size and compile time, appended per program as it is decided; the datavis emitter renders the trend per program across toolchain generations
Matrix cell	Whole-program performance suite with reference outputs and tracking, the LLVM test-suite class · `runtime/nx_lang_h2h.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lang_h2h`; declare `nx_lang_h2h TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN103 Translation validation of every optimizer rewrite: the rewritten function proven equal to the original on the IR · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tv_validate` · executor Organ · 8 u · stands on LN8, LN19
Definition of done	Alive proves LLVM peephole rewrites correct or finds counterexamples, the class the field's index names [cpplinks-compilers]; the estate's e-graph oracle (LN8) and the reduction gate's scalar-versus-packed twin are validations of one pass each. Done-rule: a validator takes the IR before and after one pass over one function and either proves equality by the e-graph under the proven rule table or produces the input on which they differ, run on every rewrite the pass count names; the gate plants a rewrite that changes wrapping order and proves the counterexample is found
Matrix cell	Translation validation of optimizer rewrites, the Alive class · `runtime/nx_opt_eqsat_pass.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_opt_eqsat_pass`; declare `nx_opt_eqsat_pass TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN104 Mined bug shapes: published compiler-bug corpora and the estate's own defect record become generator seeds and regression tests · cell WATCHING · gate NO-GATE-DECLARED

Contract	`bm_mine_shapes` · executor Organ · 5 u · stands on LN100
Definition of done	OPERATOR 2026-09-28: where no suite exists the estate invents and tests from its own intelligence, scraped bugs and other communities' feedback. The field mines miscompilation-bug corpora to steer generation (the Solidity miscompilation study, WhiteFox's white-box LLM-guided fuzzing, interleaved LLM compiler testing [arxiv-compiler-testing-2026-08]); the estate holds its own record (nx_debt rows, the equivalence log, the gate journals) and mirrors of the field's. Done-rule: a miner reads a bug corpus (ours first, then mirrored trackers) into shape rows (the construct, the pass, the door, the trigger) that the generator of LN100 weights and the corpus of LN98 gains a test per shape; the count of shapes covered over shapes mined is printed as a partition
Matrix cell	Mined bug shapes steering generated and regression tests · `runtime/nx_bugmine.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bugmine`; declare `nx_bugmine TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN105 Real-world corpus testing: the whole estate compiled and run by every candidate toolchain as a measured class · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tc_corpus_run` · executor Organ · 4 u · stands on LN100
Definition of done	The field builds whole applications as test rows and runs published code through a candidate compiler before a release [llvm-testsuite-guide]; the estate's largest real-world corpus is itself (about 25000 sources, the self-host gauntlet, every gate). Done-rule: nx_langcensus grows a build-and-run mode over the whole population per candidate toolchain, printing built, run, exit-agreed and refused as a partition that sums, appended per source; a candidate that changes any gate's verdict is refused by name
Matrix cell	Real-world corpus as the release gate, the crater class · `runtime/nx_langcensus.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_langcensus`; declare `nx_langcensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN106 Test reduction: a failing program shrunk to its smallest failing form by a sovereign reducer · cell WATCHING · gate NO-GATE-DECLARED

Contract	`tr_reduce` · executor Organ · 3 u · stands on LN100
Definition of done	C-Reduce shrinks a failing program while preserving the failure so a bug report is one screen, the class the field's index names [cpplinks-compilers]; the estate reduces by hand. Done-rule: nx_reduce takes a program and a predicate command, removes statements and declarations while the predicate holds, and prints the reduced program with the removal count; the gate plants a known failure and proves the reduced form still fails and is smaller
Matrix cell	Sovereign test-case reduction, the C-Reduce class · `runtime/nx_reduce.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_reduce`; declare `nx_reduce TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN107 Causal guidance leads to an authorized correction and independently verified outcome · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`_ABSENT_:diag_guidance_verified_accept` · executor Workflow · unestimated u · stands on LN50, LN61, codeeffectiveness:CE7 (UNRESOLVED: no such rung on this plan)
Definition of done	PLANNED CONTRACT 2026-09-30. Compose existing result-action, parser/compiler, native records, PM ownership, build and recovery owners. Bind exact input/source/import/config/implementation and authority identities; explain actual versus expected behavior, cause with evidence and a permitted next action. A stale buffer, authority change, malformed optional/mandatory semantics or incomplete effect evidence cannot trigger blind replay. Exercise correct input, wrong owner, call-order defect, misleading hypothesis, stale edit, failing fix, retained capabilities and bounded rollback. The estate drives a corrected run from the returned native data, retains closure and artifact disposition, and emits matching human/machine/AI projections. No duplicate parser, diagnostic service or private JSON protocol. A source symbol or green sample alone does not satisfy this acceptance.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `diag_guidance_verified_accept`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-30 queue 2026-09-30 operator scope is estate-wide; compiler and future IDE consume the same bottom-up contracts. Causal guidance and human/machine/AI usability are planned; no new diagnostic implementation or human study is claimed. 2026-10-01 land THE BOARD WAS RANK-REFUSED FOR NINE HOURS BY TWO UNPLACED RUNGS (2026-10-01): LN107 and LN108 were declared on 2026-09-30 without rungrole rows, so nx_ladder lang read verdict=PARTIAL with REFUSAL-RULE RUNG-UNPLACED (placed 127 of 129) and nx_compare_rank refused the board with exit 6 for every lane. The cross-board lane appended two PROVISIONAL role rows (LN107 arm toward lt-peer-systems, LN108 contender toward lt-superior) so the queue ranks again; both are the lang lane's to re-adjudicate. Owed mechanism, named rather than patched here: a rung row landing without its role row should be refused or named at the write, not discovered by the next seat that ranks

LN108 Interactive NishiLang IDE at nishifamily.com/ide · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`_ABSENT_:nishi_ide_served_accept` · executor Workflow · unestimated u · stands on LN107, LN11, LN67, codeeffectiveness:CE12 (UNRESOLVED: no such rung on this plan)
Definition of done	FUTURE ENDPOINT; DEFERRED behind bottom-up native workflow and NishiLang qualification. Reuse the language server, compiler and shared correction contract: explain, preview a source-bound change, obtain any authority still required, apply, test the original scenario and prior capabilities, show outcome and rollback. Qualify novice task completion, keyboard/accessibility, unsaved/versioned edits and actual served interaction/visual review. No-training and approved-provider controls apply to future first- or third-party LLM adapters. A build or HTTP200 is intermediate evidence. Comparison is emitted from the existing Compare/effectiveness machinery, never a manually asserted IDE superiority claim.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nishi_ide_served_accept`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN20a Loop splitting for a guard bounded by a RUNTIME value: limit = smin(n, len) computed once before the loop · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`bck_irce_runtime_bound` · executor Organ · 5 u · stands on LN20
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: bck_irce_split admits only a CONSTANT guard bound wider than the array; the loop real programs write is while k < n with n a value the loop does not change, the case LLVM's pass exists for [llvm-irce], and there every read still pays for its check (measured 2026-09-28: a fixed array under a runtime bound keeps its bounds check in the loop); done-rule: for a guard LOAD(counter) <s n with n loop-invariant, a block before the loop computes mid = smin(n, len), the main loop runs to mid check-free and the post loop to n with its checks; the induction proof accepts the smin-built bound as at most len by construction; fixtures cover n below, equal to and above len, n zero and n negative, each trapping or returning exactly as the unsplit program; the wide-guard receipt gains a runtime-bound arm beside the rivals
Matrix cell	NO-MATRIX-ROW — no matrix row carries `bck_irce_runtime_bound`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN20b Loop splitting with a pre loop: offset indexes, counters that can start below zero and descending loops · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`bck_irce_pre_loop` · executor Organ · 5 u · stands on LN20a
Definition of done	WHERE THE LANGUAGE CANNOT TODAY: the split has no pre loop because every counter the induction theorem admits is proven non-negative (a non-negative constant start, non-negative constant steps), so a[k - 5], a counter that starts negative and a descending loop are refused before the splitter is asked; done-rule: the induction theorem admits an affine index and a descending counter, the split emits pre, main and post loops with the main loop check-free, and fixtures trap at exactly the first out-of-range index on BOTH sides of the array
Matrix cell	NO-MATRIX-ROW — no matrix row carries `bck_irce_pre_loop`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

LN109 The defect-class ledger: every class is a row with its public record and its state in the language · cell WATCHING · gate NO-GATE-DECLARED

Contract	`hz_census` · executor Organ · 3 u · stands on nothing
Definition of done	knowledge/defect_classes.conf holds one row per class (its CWE ids, its matrix row, its rung and its state: unrepresentable, refused by default, refused under a mode, detected, open) and nx_hazard_census prints the partition, joins each class to the mirrored exploited-vulnerability feed (tags in total and tags added this year) and to the Top 25 rank, and writes a gauge stamp the board renders; a class with no row, a row with no rung and a feed older than its declared cadence are each a named refusal. Done-rule: the census runs on a clock row with no seat, its partition sums to the row count, a planted class with no rung turns it RED, and the lang page shows the gauge FRESH
Matrix cell	Defect-class ledger joined to the public exploit and weakness record · `runtime/nx_hazard_census.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_hazard_census`; declare `nx_hazard_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD36 The language is designed against the public defect record class by class and graded per class, never by resemblance to a rival proposed
Work log	2026-10-03 measure THE PUBLIC DEFECT RECORD READ BY CLASS, 2026-10-03, every source mirrored through nx_research_fetch and pinned on lang.refs. CISA KEV catalogVersion 2026.10.02 (1733 entries, 1733 cwes arrays, 249 dateAdded in 2026), tag occurrences counted by nx_txtscan over the mirror: CWE-78 110, CWE-787 105, CWE-416 93, CWE-119 87, CWE-843 38, CWE-122 33, CWE-125 17, CWE-190 16, CWE-362 12, CWE-400 5, CWE-476 1. MITRE 2025 Top 25 in list order: 79, 89, 352, 862, 787, 22, 416, 125, 78, 94, 120, 434, 476, 121, 502, 122, 863, 20, 284, 200, 306, 918, 77, 639, 770. Reading: the exploit record is memory corruption plus injection; the outage record (four vendor post-mortems read the same hour) is null and unhandled errors, an underived limit, a stale check and restarts with no backoff; null dereference is rank 13 on the weakness list with one exploited tag, so an exploit-only scoreboard would never rank the class that took two clouds down. Both records are kept 2026-10-03 land MILESTONE M10 LANDED AS BOARD DATA 2026-10-03 under the operator's order of the same day: one dated bar (SB-HAZARDS, October 2026), a best-in-class and a frontier target, thirteen rungs LN109 to LN121 each with a role, eight design rows LD29 to LD36 whose prevented error class is the earlier language's flaw with its pinned evidence, thirteen matrix rows, nine axes rows for the scanner's seeds and ten pinned references. The six classes this board already carried (typed bounds, raw-pointer provenance, use after free, integer overflow, null, data races) keep their rows and rungs; M10 adds the classes no rival column closes. Nothing here is built: every new cell is a watch 2026-10-04 queue BUILT AND REFUSED BY ITS VERIFIER ON ONE GROUND, REPAIR IN FLIGHT. The census gave the right answer on every probe, including the real 1733-record catalog, where an independent count agreed on every figure (CWE-416 93 records and 7 in 2026, 249 added in 2026, longest gap between publishing days 8). The gate lacks negative controls on the gauge stamp: four one-line regressions left it 255 of 255 while the stamp would read clean beside a RED census. Also found: a catalog with zero records reads GREEN, one mistyped later year takes the whole ranked list out of force, and an artifact that cannot be executed reads RED instead of a missing precondition. A repair seat has those plus the verifier's nine surviving mutants; the production conf, the census clock row and its gauge row land after the re-verification

LN110 Resource budgets: an allocation, a queue or a retained collection carries a bound derived from its input or a declared budget · cell WATCHING · gate NO-GATE-DECLARED

Contract	`budget_check_alloc` · executor Organ · 5 u · stands on LN109
Definition of done	A table sized for 200 rows fed more than 200, and the heap exhaustion the embedded Lisp paper in the month's listing reports from real users, are one class: a size nobody derived. Under the budget mode a function that allocates in a loop or grows a collection names where its bound comes from (an input length, a conf row, a caller's budget), and exceeding it is a typed outcome the caller must consume, never a trap. Done-rule: the mode refuses an unbudgeted growth site in a fixture and accepts the derived twin, the over-limit fixture returns the typed refusal carrying the limit and the offered size, and the estate census prints budgeted, derived and unbudgeted sites as a summing partition (LN60 is the toolchain's half and stays its own rung)
Matrix cell	Resource budgets: sizes derived or budgeted, over-limit a typed outcome (CWE-770 and CWE-400 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD31 A size is derived from its input or a declared budget and exceeding it is a typed outcome proposed
Work log	no log row names this rung yet

LN111 Termination evidence: a loop carries a variant the compiler proves or a fuel budget it spends · cell WATCHING · gate NO-GATE-DECLARED

Contract	`term_check_loop` · executor Organ · 4 u · stands on LN17, LN109
Definition of done	The induction pass already classifies counted loops for bounds elision (LN17, LN20) and the same facts are a termination proof. Under the terminate mode a while loop whose guard the pass cannot bound must spend declared fuel, and running out is a typed outcome; the eBPF verifier refuses loops outright and the month's fixpoint paper shows a detector people trusted was unsound, so the evidence is checked and never assumed. Done-rule: every loop in the estate is censused proven, fueled or unproven as a summing partition, the mode refuses an unproven loop in a fixture, and a fueled loop that exhausts its fuel returns its outcome on the first excess iteration
Matrix cell	Loop termination evidence: a proven variant or spent fuel (CWE-835 class) · `runtime/nx_bck_elide.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bck_elide`; declare `nx_bck_elide TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD32 A loop proves its variant or spends fuel proposed
Work log	no log row names this rung yet

LN112 Every wait has a deadline: a blocking call without one does not compile under the mode · cell WATCHING · gate NO-GATE-DECLARED

Contract	`wait_deadline_required` · executor Organ · 3 u · stands on LN109
Definition of done	Rust lists deadlocks among the behaviours it does not consider unsafe, and the estate's own outages were waits with no bound (a daemon start that slept on a registry lock for eight minutes, a slot pool wedged behind a dead holder). The stdlib's blocking calls (futex wait, lock, lease, socket read, child wait) take a deadline value, an unbounded wait is spelled never with a reason and is counted, and a deadline is derived from the resource it waits on. Done-rule: the mode refuses a blocking call with no deadline in a fixture, the census partitions every blocking site in the estate into deadline, never-with-reason and bare, and the bare count is a ratchet that only falls
Matrix cell	Deadlines on every blocking call (CWE-833 and CWE-667 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD30 Every blocking call takes a deadline and never is spelled with a reason proposed
Work log	no log row names this rung yet

LN113 Lock order by level: taking a lower lock while holding a higher one is a compile-time refusal · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lock_level_check` · executor Organ · 4 u · stands on LN112
Definition of done	Deadlock by lock order is excluded for every statically named lock: each lock or lease declares a level and the compiler tracks the held set through calls; dynamic acquisition goes through try-with-deadline (LN112), so no path waits forever on an order nobody declared. Done-rule: the two-lock inversion fixture is refused naming both sites, the consistent-order twin compiles, and the estate's lock and lease sites are censused with their levels
Matrix cell	Lock order by level (CWE-833 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD30 Every blocking call takes a deadline and never is spelled with a reason proposed
Work log	no log row names this rung yet

LN114 An error is a value that must be consumed: no trapping unwrap and no silently dropped status · cell WATCHING · gate NO-GATE-DECLARED

Contract	`mustuse_check_result` · executor Organ · 3 u · stands on LN2, LN109
Definition of done	A null pointer with no error handling took a cloud control plane down and an unwrap on an error value took a proxy fleet down; both are one class, an error nobody was made to handle. A call that returns a status or an Option may not be discarded, the only way to drop one is ignore with a reason (counted), and no construct turns an error value into a trap in a non-test build. Done-rule: the mode refuses a discarded status and an unconsumed Option in fixtures, the census partitions every call site in the estate whose result is dropped, and the corpus builds unchanged with the mode off
Matrix cell	Errors must be consumed and no unwrap traps (CWE-252 and CWE-248 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD29 An error is a value the caller must consume and no construct turns one into a trap outside a test build proposed
Work log	no log row names this rung yet

LN115 Horizon types: a counter or a clock declares its unit and the lifetime it must survive · cell WATCHING · gate NO-GATE-DECLARED

Contract	`horizon_check_counter` · executor Organ · 3 u · stands on LN1, LN109
Definition of done	The directive names only a software counter that overflows after 248 days; that number is what a signed 32-bit count of hundredths of a second gives (2 to the 31st hundredths is 248.55 days), arithmetic nobody ran. A counter type carries its unit and maximum rate, the compiler computes the overflow horizon from the width and refuses one shorter than the declared lifetime, time values carry a unit so seconds and nanoseconds cannot be added, and the unit calculus with conversion in the month's listing is the formal bar. Done-rule: the 32-bit hundredths fixture is refused with the computed horizon in the message, the 64-bit nanosecond twin compiles with its horizon printed, a seconds-plus-nanoseconds fixture is refused, and the estate's epoch and counter sites are censused by unit and width
Matrix cell	Counter and clock horizons declared and computed (the anti-Y2K class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD33 A counter or a clock declares its unit and the lifetime it must survive and the compiler does the horizon arithmetic proposed
Work log	no log row names this rung yet

LN116 A check on shared state returns a token and the act must present it · cell WATCHING · gate NO-GATE-DECLARED

Contract	`stale_check_refuse` · executor Organ · 4 u · stands on LN6, LN109
Definition of done	The AWS event was a check made once at the start of a long operation and trusted at the end. A read of a shared value yields a version token, a write that depends on that read presents the token and fails when the version moved, and compare-and-swap is the only write path for a value declared shared; the estate already works this way by doctrine at its file door (an expect token on every write) and this makes it the language's rule. Done-rule: the stale-plan fixture (two writers, the slow one holding an old check) is refused at the write with both versions named, the token twin compiles and loses the race visibly, and the estate's shared-plane writers are censused by whether they carry a token
Matrix cell	Versioned checks on shared state: the act presents the check's token (CWE-367 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD34 A check on shared state yields a version token the later write must present proposed
Work log	no log row names this rung yet

LN117 Interpreter sinks take typed builders: bytes from outside cannot reach a command, a query or a page unencoded · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sink_typed_builder` · executor Organ · 5 u · stands on LN109
Definition of done	OS command injection carries more exploited-in-the-wild tags than out-of-bounds write and no memory-safe language closes it. Bytes that arrive from outside are tainted by type, a sink (process arguments, a query, markup, a path) accepts only a builder that encodes each part for that sink, and concatenating a tainted value into a sink string is refused. Done-rule: the mode refuses the concatenation fixture for each of the four sinks and accepts the builder twin, the estate's sink sites are censused builder, encoded or raw as a summing partition, and the raw count is a ratchet
Matrix cell	Injection refused by typed sinks and tainted input (CWE-78, CWE-77, CWE-89 and CWE-79 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Design rows	LD35 Bytes from outside are tainted by type and a sink accepts only a builder that encodes for that sink proposed
Work log	no log row names this rung yet

LN118 Strings carry their length: the scan-to-terminator API is a named legacy class under a ratchet · cell WATCHING · gate NO-GATE-DECLARED

Contract	`str_slice_default` · executor Organ · 4 u · stands on LN3, LN109
Definition of done	The estate inherited the C convention and has paid for it once already (the 2026-07-08 read past a missing terminator, now the provenance gate's fixture). New string APIs take a checked slice, a scan that walks to a terminator is censused by site, and the count only falls. Done-rule: the stdlib string surface exists over slices with the same known answers as the pointer twins, the census prints slice sites and scan-to-terminator sites as a summing partition with the baseline recorded, and a new scan-to-terminator site in a changed file is refused by the ratchet
Matrix cell	Length-carrying strings by default (CWE-170 and CWE-126 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN119 A retry carries a budget and jitter or it does not compile under the mode · cell WATCHING · gate NO-GATE-DECLARED

Contract	`retry_budget_required` · executor Organ · 2 u · stands on LN112
Definition of done	The recovery from the null-pointer outage was slowed by restarts with no randomized backoff, and the estate measured the same herd in its own job follower. The stdlib retry primitive takes an attempt budget, a wall-clock budget and a jittered ladder, and a hand-rolled loop that re-issues a network or lock call is refused under the mode. Done-rule: the bare retry-loop fixture is refused and the primitive twin compiles, the ladder's arithmetic is a known-answer tooth, and the estate's retry sites are censused primitive or hand-rolled
Matrix cell	Retry with a budget and jitter (the retry-storm class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN120 Implicit conversions are refused: every narrowing, sign change and pointer-integer crossing is spelled · cell WATCHING · gate NO-GATE-DECLARED

Contract	`coerce_refuse_implicit` · executor Organ · 2 u · stands on LN109
Definition of done	Type confusion carries 38 exploited tags and silent coercion is the scripting languages' textbook flaw. The estate writes its casts by hand already; this rung proves the compiler refuses the alternative. Done-rule: fixtures for narrowing, sign change, pointer to integer and integer to pointer without a cast are each refused naming the two types, the positive twins compile, and the gate is rostered so a parser change that admits one turns it RED
Matrix cell	Implicit conversions refused (CWE-704 and CWE-843 class) · `runtime/nx_parse.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_parse`; declare `nx_parse TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

LN121 The research watch for this ladder runs with no seat: sources, seeds and proposals as data on a clock · cell LANDED · gate NO-GATE-DECLARED

Contract	`fs_src_applies` · executor Organ · 3 u · stands on nothing
Definition of done	The frontier scanner attests every bar daily, yet it asks graphics venues about language bars (204 fetches for 12 bars, measured 2026-10-03), scans only rows where a named rival leads, and nothing runs its propose verb on a clock. Sources gain a per-board scope, a board can mark rows to watch even when no rival leads, the language venues and the weakness feeds become source rows, and propose runs daily for this board and writes a gauge stamp the page renders. Done-rule: a day passes with no seat and the board shows the proposal gauge FRESH, the attest for this board fetches only its own sources, and a planted on-subject item in a fixture listing appears as a proposal while a homonym does not
Matrix cell	Research watch for this ladder with no seat: scoped sources, watched rows, proposals on a clock · `runtime/nx_frontier_scan.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_frontier_scan`; declare `nx_frontier_scan TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-03 measure THE ESTATE'S OWN ATTESTER RE-EARNED THIS BOARD'S BARS WITH NO SEAT READING FOR IT, 2026-10-03: nx_frontier_scan attest lang printed ATTEST-DONE bars=12 appended=1 already=9 unattestable=2 fetches=204 newer_sources=3 stale_bars=0 verdict=ATTESTED, and nx_compare_rank then read BARFRESH fresh=2 attested=10 stale=0 verdict=FRESH. The cost is the finding: 17 dated sources were asked about every bar and most are graphics and biomedical venues (SIGGRAPH and its Asia edition, Eurographics, CVPR, ECCV, IEEE VR, the kesen indices, Europe PMC), whose three NEWER verdicts were a radiography paper and two unrelated repositories. Sources are not scoped by board, which is LN121's first leg 2026-10-03 lesson A LOOSE QUERY STALES A BAR ON HOMONYMS AND HIDES THE REAL ENTRIES AT THE SAME TIME. The testing bar's listing was the all-fields phrase compiler testing: its two September entries were a GPU physics benchmark and an agent runtime, so the attester read newest 2026-09 and the bar went stale on nothing, while a subject-tight listing (cs.SE or cs.PL with the testing phrases in the abstract) showed two genuine September entries the loose one never returned (Trivet, 147 of 148 LLVM transformations verified or refuted with the Lean kernel checking every verdict; Faultless, translation validation for neural decompilers). The query is the per-reference subject filter: it needs no organ change, and the attester re-earned the bar by itself the same hour. A board-wide category class cannot do this for a board whose bars span several subjects 2026-10-03 queue WHAT STILL NEEDS A SEAT, NAMED. (1) Re-declaring a bar when a listing moves to a new month: the attester detects it and the ranker refuses, but reading the new entries and rewriting the bar is adjudication, and the estate's local engine cannot author it yet; a computed bar (the class counts LN109's census rewrites from the feed) removes the seat for the measurable half. (2) Admitting a proposal: the scanner proposes and never admits, by design. (3) Authoring the compiler passes behind LN110 to LN120. (4) Rendering the proposal rows on the page: the emitter shows the gauge today and has no reader for the proposal plane. (5) The sovereign TLS client cannot complete a handshake with blog.sigplan.org (a TLS 1.2 alert after a 1.3 hello it could not finish), so the SIGPLAN blog is a named unreachable source and not a silent gap; the estate's PDF text reader returned binary control bytes for the JPL coding-rules paper, so that source is mirrored and pinned by the fetch receipt but unread and uncited 2026-10-03 retract RETRACTED THE SAME HOUR: item (4) of the queue row above said the emitter has no reader for what the research watch finds. It has one and it was already publishing. A board that carries an .axes file gets /compare/<board>/frontier/ from nx_swcompare_gapmap on every regen (our symbol's presence against keyword momentum over the banked corpus), and the nine axes rows landed today rendered there on the next publish (16654 bytes, was 13302; deadlock read 1 mention and OPPORTUNITY, resource budgets 0 and dormant, multi-language boundaries 7). What is true instead: the radar reads banks written by the researcher fetcher nx_swcompare_research, and nx_catalog reads that fetcher SOURCE-ONLY (never built, promoted, registered or scheduled), so the momentum is computed over banks whose newest record is dated June 2026; and the scanner's separate proposal plane has no page. The discriminating read was the regen receipt, which named the frontier page it published 2026-10-03 measure WHY THE WATCH DID NOT RUN WITHOUT A SEAT, MEASURED 2026-10-03 FROM THE CLOCK PLANE AND THE CATALOGUE. nx_clockjob list: 157 effective jobs, 114 in schedule_state WAITING_AUTHORITY with executable_binding UNBOUND, 41 bound to an expected sha256, 3 stopped. The daily attester row (frontierattest, nx_frontier_scan attest all) and the daily topic watch (frontier-watch-daily) are both among the unbound and both show a next_due about ten days in the past with execution_proven=0, so every October attestation on this board so far was a seat's hand run. Three legs of the research watch were dark at once: the bank fetcher unbuilt, the attester unbound, and the proposer on no clock row at all. The radar and the bar ruler were live and therefore read as a working watch 2026-10-03 land THE RADAR CORPUS REFRESHES ITSELF. nx_swcompare_research was write-once (a bank that existed was skipped forever) and had never been built. It is rewritten on a decision library (nx_radarbank_lib: first fetch, fresh, refresh, or keep when no bound is given; a staged bank replaces the live one only when it holds a byte, the previous generation is copied beside it as .txt.prev before the rename, and a failed fetch leaves the live bank untouched and is counted kept_stale). The staleness bound is not a number in the source: the clock row passes its own interval. Gate nx_radarbank_gate 62 of 62 on the laptop and on the NAS with no network (the decision at and around a clock-derived bound, the spec row reader, the swap, and the organ end to end on a per-run fixture tree); a mutant of the library was killed with the source restored byte-identical. Promoted nx_swcompare_research 8c8de11d (525932 B) and nx_radarbank_gate 09f4018b (121284 B), both registered. First production run: RADARBANK domain=lang banks=20 fresh=0 refreshed=7 first=13 kept=0 kept_stale=0 failed=0 sum=20 partition=SUMS shrank=5 verdict=GREEN. The seven banks last written in June (age 5110975 s) were refreshed; thirteen were new (nine hazard-class searches and four venue listings over OpenAlex: PACMPL, PACMSE, Empirical Software Engineering, Information and Software Technology; the venue ids were read from mirrored OpenAlex source records) 2026-10-03 land THE PROPOSER ASKS ONLY SOURCES THAT COVER THE BOARD AND WALKS THE WHOLE BOARD OVER TIME. nx_frontier_scan gained fs_src_applies (data rows in knowledge/frontier_sources.conf: scope, board, only or skip, kinds, for the board's side; srcfor, kind, boards, for the source's side, so a source added for one board is not asked by the others), watch seeds (every .axes keyword is asked as its own seed beside the deficit rows), a rotation cursor so each pass starts where the last stopped, a propose stamp in the gauge grammar (axes = sources that answered of sources askable, so an unanswered source reads BLIND), a token-share floor from conf (scan_seed_permil), and scanfx, an offline twin of propose that reads fixture bodies so a gate holds all of it with no request leaving the box. Eight sources were added for this board: arXiv cs.PL, cs.SE, cs.CR and cs.LO, and OpenAlex title-and-abstract search inside the four venues above. Gate nx_frontier_scan_gate 64 of 64 on the NAS against the candidate (19 new teeth); a by-hand triple mutant turned exactly the scope, relevance and rotation teeth RED. Promoted nx_frontier_scan f0e045c4 (209584 B) and its gate 74c29e3b (97392 B). The pre-change scanner is banked at knowledge/retired/nx_frontier_scan.elf.pre-ln121-a4dbd86d 2026-10-03 measure BEFORE AND AFTER ON THIS BOARD, SAME DAY, SAME ORGAN, AND ONE CORRECTION. Before (every source asked for every board, novelty to the board the only test): sources=17 fetches=84 PROPOSALS=14. I first reported all fourteen as off-subject; reading each record showed THIRTEEN off-subject (a hackathon post, an attendance tracker, a robotics kit, eight papers from Europe PMC in medicine, chemistry and credit scoring, a second forum post and a machine-learning tutorial repository) and ONE on subject: btravstack/unthrown, a library whose description reads explicit errors as values, filed against the errors-as-values row. After (scoped): SCAN-DONE domain=lang deficit_rows=42 rows_scanned=6 sources=25 fetches=48 PROPOSALS=2 population=128 watch_seeds=86 askable_sources=8 answered_sources=8 off_seed=1 empty_seeds=0. The two: a memory-tagging paper whose abstract says use-after-free (on subject) and a code-cleaning toolkit (off subject when read). So scoping removed the noise sources and cost the one real find, which came from GitHub, a source the scope row now leaves out. Two proposals is one pass over 6 of 128 seeds and is not a rate 2026-10-03 measure THE THREE BEATS ARE DECLARED, BOUND AND IN THE LIVE PLANE; NONE HAS FIRED YET. nx_clockjob get reads each row plane=LIVE scheduled=1 guarded=1 executable_binding=EXPECTED_SHA256 execution_proven=0: langradarbank every 604800 s (nx_swcompare_research lang 604800, next due 1791670525), langpropose every 21600 s (nx_frontier_scan propose lang, next due 1791087337), langattest every 86400 s (nx_frontier_scan attest lang, next due 1791152137). Cadence reasons: the proposer asks 6 of 128 seeds a pass, so at six hours the whole population is asked in about 5.3 days, inside one weekly bank refresh; the attester is daily because a bar is judged by month and one day is the smallest step a listing date moves; the banks are weekly because the radar reads momentum, not single papers. A bound row fires only while the executable matches its sha256, so promoting either organ again stops its rows until they are re-bound: the re-bind is part of every promote of these two organs. The proof that the watch runs with no seat is a stamp whose timestamp moves at those epochs; it is not claimed before then 2026-10-03 lesson A DEFICIT ROW'S LABEL IS WRITTEN IN THE ESTATE'S WORDS AND THE FIELD DOES NOT ANSWER TO THEM. The second pass asked six row labels (the first four content words of each, joined by the source's AND) of nine sources: 54 fetches, every source answered, and the answers held one record in total, already covered by the board. Labels such as the estate builds itself in its fastest proven-sound mode are sentences about this estate, so an empty answer there is the question's fault and says nothing about the field. The 86 watch keywords are the field's vocabulary and are where the watch hears anything; the rotation reaches them after the 42 rows 2026-10-04 lesson A TOKEN-SHARE FLOOR CANNOT FAIL ON A SOURCE THAT ANDS THE QUERY WORDS. The relevance floor shipped this morning asks that a record hold half the seed's words. A search that ANDs those words returns only records that hold all of them, so the floor passed 16 of 17 real records when four saved responses were replayed through scanfx (two from GitHub, two from arXiv), and one of the 17 was on subject by its own test. Two attempts at a sharper rule failed on the same replay before one held: pairing any two long words let a robotics kit through on the words with enforced; dropping function words through the estate's stopword list would have erased use after free, because after is on that list. The rule that holds: a record must carry three consecutive words of the row label or watch keyword standing together (every word counts, short ones too), or two consecutive content words of it, never across a double quote. On the 17 records, each one read: 2 proposed, both on subject (the errors-as-values library and the memory-tagging paper), 15 rejected, all off subject. The count of three is a conf row (scan_phrase_ngram) carrying that calibration 2026-10-04 land THE PHRASE RULE IS PROMOTED AND THE BEATS ARE RE-BOUND TO IT. nx_frontier_scan 0a3e75e6 (217168 B) and its gate c07444a3 (105016 B) are live; the NAS gate read 78 of 78 against the candidate before the promote (14 new teeth: words standing together across a short word, the same words scattered, words split across two quoted strings, a pair leaning on a function word, a one-word keyword, and a term of art made of three short words matched through its hyphens and refused in another order). The content ruler named one lost string, the six-buckets sentence the seven-buckets sentence replaces. Promoting changed the executable's hash, so langpropose and langattest read BOUND-DRIFT for about a minute and were re-bound (revisions 274 and 275, next-due times unchanged). GitHub is back in this board's scope now that the phrase rule guards it. A dry pass on the promoted binary read SCAN-DONE fetches=54 PROPOSALS=0 askable_sources=9 answered_sources=9 off_seed=1 off_phrase=1. The 14 proposals that read off subject are set REJECTED-OFF-SUBJECT in the proposal plane (counted there: 14); the two real finds stay OPEN for a seat or a later admitter 2026-10-04 queue FOUND WHILE RE-BINDING AND NOT THIS LANE'S TO FIX. The bind planner read rows_read=169 bound=41 bound_drift=2 bind_ready=114: siteliveness and toolregreconcile are bound to a hash their executable no longer has (each was promoted again without a re-bind), and the planner calls a drifted row a global barrier for the dispatcher. The clock was dispatching while they drifted (an hourly stamp was four minutes old), so the barrier is at most per row; what it costs is that those two beats do not run. They belong to their owning lanes. The 114 unbound rows include the fleet attester frontierattest, so every board other than this one still gets its bars attested by hand 2026-10-04 land THE NEW GATES ARE ON AN EXECUTION SURFACE AND THE FEED HAS A BEAT. Five gates were run bare from the serving root (the gate roster's own invocation) and then added to knowledge/gateroster.conf: nx_radarbank_gate 62 of 62, nx_frontier_scan_gate 78 of 78, nx_dumpcheck_gate 179 of 179, nx_leaderboard_fleet_gate 199 of 199, nx_progen_reap_gate 139 of 139; the compiler-backed nx_progen_gate takes minutes and is left off on purpose. knowledge/organ_gate.conf gained the two pairs no derivation rule reaches (nx_swcompare_research to nx_radarbank_gate, nx_leaderboard to nx_leaderboard_fleet_gate). The exploited-vulnerability feed the LN109 census will read now has a stable path and a daily bound clock row (kevfeed, revision 279: nx_research_fetch to knowledge/fetched/cisa_kev_current.json); the first fetch saved 1765906 bytes, the same digest as the pinned citation mirror, which stays untouched because its pin is its hash

dossiers=144 cells_joined=120 no_matrix_row=24 (sum 144) gates_recorded=0 gates_unrecorded=3 no_gate_declared=117 (sum 120 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — unassessed

Comparative scores unavailable: 44 peer cells are unassessed. Establish cited assessments before comparing positions. Unknown cells are not absence; no zero scores or history observations were generated.

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 572, unassessed 44. Authored assessments are not verified outcomes.

Capability	Nishi	Rust	Zig	Go	Elm
SIMD lane intrinsics for the quantized LLM decode (nibble unpack and scale, i16 multiply-add) Source present; authored stronger claim: `x86ctx_emit_q4kunpack32s` in `runtime/nx_x86_64_ctx.nx`, verified at emit. LANDED 2026-09-02 (lang LN28): __q4k_unpack32s emits 14 AVX2 instructions that turn a Q4_K sub-block pair into 64 scale-multiplied i16 lanes, beside the existing __i16x16_madd and __q5_unpack32; proven lane-exact and dot-exact (nx_q4k_simd2_gate 9 of 9) and 3.94x over the scalar unpack. Rust and Zig expose lane intrinsics (std::arch, @Vector); Elm has none; Go reaches SIMD only through hand-written assembly. EXCEED: the intrinsic is specified as exact integer arithmetic with a bit-exact gate, so a quantized decode built on it is deterministic across hosts rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	●	○	◐
Self-hosted sovereign compiler (native x86-64 ELF) Measured: `func main(argc` exists in `runtime/nx_compile_x86.nx`, verified at emit. Self-hosts through nx_cc_sovereign.elf; equiv gate 10/10 GREEN + self-host gen2/gen3 (blessed 2026-07-07); Elm compiler is Haskell-hosted rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTRY-MISPOINTED` — PARTIAL: the organ is present but its registered path does not stat: re-register it at a path that exists. dossiernot adopted: the organ is present but its registered path does not stat: re-register it at a path that exists Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons not adopted yet: the organ is present but its registered path does not stat: re-register it at a path that exists	●	●	●	●	○
Optimization pipeline (const-fold SCCP mem2reg GVN CSE LICM DSE DCE) Measured: `func opt_gvn_block` exists in `runtime/nx_opt.nx`, verified at emit. About O1-class today; LICM correctness-gated; Rust rides LLVM full O3 depth rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=53 nonval=49` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	●	●	●
Generics + monomorphization Measured: `instantiate_generic_n` exists in `runtime/nx_parse.nx`, verified at emit. Full monomorphization port landed; Go added generics in 1.18 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Sum types + pattern match Measured: `parse_stmt_match` exists in `runtime/nx_parse.nx`, verified at emit. Payload ctor and match probes re-verified run-exit=0 (2026-07-09, earlier SIGSEGV fixed by the 07-07 bless); Go lacks sum types; Elm ADTs are the bar rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	○	◉
Threads / parallel runtime Measured: `nx_pool_submit` exists in `runtime/nx_thread_pool.nx`, verified at emit. Ring-arena pool, measured 7x pooled speedup (2026-07-06 gate); Go goroutines lead; Elm has no threads rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=46 nonval=27` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Go (leads)	●	●	●	◉	○
Bounded-loop safety primitives (JPL Rule 2) Measured: `nx_loop_begin` exists in `runtime/nx_loop.nx`, verified at emit. nx_loop watchdog and settle primitives; peers leave loop bounds to external lint standards Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○
WebAssembly target Measured: `wat_emit_module` exists in `runtime/nx_wasm.nx`, verified at emit. Own .nx to .wat to .wasm chain (nx_wat_compiler); Rust wasm ecosystem leads; Elm targets JS only rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	●	●	○
RISC-V target Measured: `func materialise` exists in `runtime/nx_riscv.nx`, verified at emit. Second native backend; the linear-scan allocator (nx_regalloc, Poletto-Sarkar) is wired HERE, not x86 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=12 nonval=11` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
In-repo compiler fuzz generator Measured: `sp_atoi` exists in `runtime/nx_shapeprobe.nx`, verified at emit. Shape-axis generator found a real nx_cc bug (about 1500 early-exit blocks = empty .s, 2026-07-05); peers rely on external fuzzers (rustlantis, go-fuzz) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	◐	◐	◐	○
Differential EMI oracle on the compiler gate Measured: `eq_build` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Baseline-vs-challenger build+stdout byte-equal + self-host stage; gate 10/10 GREEN (2026-07-07); born catching a silent optimizer miscompile rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	◐	◐	◐	○
Per-function miscompile bisector Measured: `sb_try_franken` exists in `runtime/nx_cc_splice_bisect.nx`, verified at emit. Function-splice frankenbuild names the breaker function; Rust cargo-bisect-rustc bisects nightlies, not functions rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: source exists, never compiled: /api/build it	●	◐	○	○	○
Compiler health witness, autonomously driven Measured: `run_argv` exists in `runtime/nx_cc_health.nx`, verified at emit. Generate-build-verify witness; nx_exec_engine drove it 3/3 GREEN autonomously (2026-07-06) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	●	●
Never-brick compiler bless (equiv-gated install + rollback) Measured: `bc_equiv_green` exists in `runtime/_hdl_build/nx_bless_compiler.nx`, verified at emit. Refuses install unless differential equivalence is GREEN; byte-identical corpus check rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-UNAUTHORISED` — PARTIAL: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Equality-saturation engine Measured: `nx_eqsat_union` exists in `runtime/nx_eqsat.nx`, verified at emit. BUILT AND GATE-PROVEN FOR THE FIRST TIME 2026-08-14, and it took two real fixes to get there. (1) THE ENGINE DID NOT COMPILE: NX_EQSAT_W was declared 470 lines below its first reader, and nx_cc refuses that because the reader would silently see 0 -- which would have inverted every shift-width soundness guard and fired the mul-to-shl rewrite exactly where nx_rule_soundness proved it UNSOUND. Nobody had noticed because a leaf lib is never built directly and all 10 importers were unbuilt too. (2) TWENTY-SEVEN CALL SITES ALLOCATED TOO FEW BYTES FOR NxEGraph: the struct has grown to 35 fields = 280 bytes, and the sites asked for 128, 256 or 96 -- not one asked for 280. Everything from hc (offset 128) onward, which is the entire meet, DSL, const-fold and match-worklist state these very proofs certify, was written OUT OF BOUNDS; the 96-byte sites overran by 184. CORRECTION TO MY OWN FIRST NUMBER, published here earlier today as nine sites across five files: that was the population of ONE SPELLING. The first sweep grepped the literal `sys_mmap(128) as NxEGraph` and missed the 256 and 96 variants entirely, including the worst of them. A SWEEP THAT MATCHES THE WRONG VALUE REPORTS A CLEAN POPULATION AND LEAVES THE WORST SITES LIVE -- the honest scan keys on the CAST (`as NxEGraph`), not on the size. What actually surfaced the miss was the arena's own ring detector: nx_eqsat_dsl_parity_test printed ARENA-OVERRUN prev_alloc_size=256 eight times WHILE REPORTING 15/15 GREEN, which is why a green verdict is never a substitute for reading the output. All 27 sites now derive from NX_EQSAT_GRAPH_BYTES (corpus_complete=1) and the same gate re-runs 15/15 with ZERO overruns. Three comments in the struct asserted page-rounding made the new fields fit; that stopped being true when NXA_SMALL_MAX moved 64->256 on 2026-08-07, the identical ARENA-OVERRUN prev_alloc_size=128 signature recorded in rv64im_min_sim.nx:111. Now sized by NX_EQSAT_GRAPH_BYTES. RESULTS -- SEVEN GATES, 93 TEETH, ALL FIRST RUNS EVER: nx_eqsat_membership_proof_test 22/22 GREEN (membership-as-proof certificate over a 3,584-vector battery against FOUR load-bearing controls, the sharpest being the k=W boundary that a pure equality sweep is PROVABLY BLIND TO -- both sides mask to zero for every vector, so only the side-condition catches it -- plus an undersized provenance log that must fail CLOSED rather than silently drop entries). nx_eqsat_bw_witness_gate 4/4 GREEN (1,048,576-vector exhaustive mod-2^W proof of the truncation semantics every other rule rests on; it was labelled a throwaway witness, had never been compiled, and could not even be RUN through the gate door until renamed, since /api/gate_run admits only names ending gate/test/kat). nx_opt_eqsat_oracle_gate 13/13 GREEN and REGISTERED, bite-proven RED 9/12 on a planted mutant. nx_eqsat_constfold_test 25/25 GREEN -- the deepest of them, with FIFTEEN named negative controls including five ops the folder must REFUSE for want of a faithful oracle cell (DIV, REM, SHR because logical is not arithmetic, SAR, NEG because NOT is not negate) and the sharpest control in the family: a back-door RULE_NONE merge whose endpoints genuinely DO share a class, so membership holds, and whose certificate must still FAIL because the merge cites no proven rule. nx_eqsat_congruence_test 10/10 GREEN (egg-style deferred congruence closure, cited fail-closed provenance, plus controls proving the rebuild is load-bearing and that NEG vs NOT on the same child is never merged) and nx_eqsat_rule_proof_test 4/4 GREEN (exhaustive 256-vector triangulated proof of mul-to-shl through two independent netlist legs and an oracle, with an unsound-shift-by-4 control proving the comparison can fail). Engine present and far deeper than this note used to claim (it said union-find and constfold rules): 2026-08-14 inventory found egg-style deferred CONGRUENCE CLOSURE, a const-fold e-class analysis with an explicit refusal set (DIV, REM, SHR, SAR, NEG are NOT folded), a DATA-DRIVEN rule DSL with a general e-matcher proven behaviourally identical to the hand-written rules, and a provenance log -- carried by its own gate family (congruence, constfold, dsl-parity, membership-proof, rule-proof, bw-witness) plus four benches. Peers do not ship eqsat either. Adoption: `LIB-WIRED importers=12 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Equality saturation CONSUMED by a backend Measured: `opt_eqsat_pass` exists in `runtime/nx_opt_eqsat_pass.nx`, verified at emit. RESEARCH BAR 2026-09-01: strategy design is the open half of EqSat (EggMind, LLM-synthesised reusable strategies with a strategy DSL, proof-derived rewrite-motif caching and tractability guidance, arXiv Apr 2026) [arxiv-eggmind-2026]. THE PASS EXISTS AND REWRITES REAL IR AS OF 2026-08-14 -- opt_eqsat_pass (runtime/nx_opt_eqsat_pass.nx), gate-proven 10/10 by nx_opt_eqsat_pass_gate, registered. It builds a small e-graph per two-operand integer instruction with non-constant operands keyed on their SSA VALUE ID, saturates under the data-driven rule table plus the const-fold analysis, extracts the cost-minimal form, and folds the result when that form is a constant -- using the incumbent rewrite mechanism copied from opt_const_fold, introducing no new way to mutate IR. THE HEAD-TO-HEAD, ON ONE FUNCTION: for x xor x with x a runtime parameter, the incumbent opt_const_fold folds ZERO instructions (it structurally requires both operands constant) and opt_eqsat_pass folds ONE, to the constant 0. That gap is currently unmitigated in the shipping pipeline because opt_simplify, the peephole that would catch some of these, is BISECT-DISABLED in opt_run after a self-host miscompile. Controls: two distinct parameters are NOT folded, and OP_DIV_S is DECLINED because the gate simulator has no faithful cell for division, so the engine refuses to model it. Declared narrowness: i32 results are skipped rather than duplicating opt_const_fold mod-2^32 wrap, because a second wrapping ruler is how silent wrong values get made. THIS CELL STAYS OPEN ON PURPOSE. nx_opt_eqsat_oracle_gate (13/13 GREEN, registered, bite-proven RED 9/12 on a planted mutant) makes the engine an ORACLE OVER the shipping optimizer: over the WHOLE reachable domain -- k = 1..62, not a sample -- it checks that opt_strength_reduce and the proven equality-saturation rule agree on when x2^k becomes x<<k, and that the largest shift the optimizer can emit stays inside the region nx_rule_soundness proved sound. WHAT THAT CHECK FOUND, STATED PLAINLY: the optimizer is CORRECT. is_pow2 rejects n<=1 and a positive i64 caps k at 62, so the unsound k>=64 region is unreachable and there is no miscompile. The real defect was that this was true BY ACCIDENT OF THE TYPE and nothing asserted it -- a wider constant or an edited is_pow2 would have deleted the guarantee silently, and silent-wrong-value is the worst class this estate tracks. THE CONTRACT IS STILL OPEN BECAUSE AN ORACLE IS NOT A PASS: nothing yet REWRITES IR through the e-graph, and naming this function opt_eqsat_pass to turn the cell green would be exactly the stub-carrying-the-contract-name defect the hive law warns about. THE ADOPTION GAP, MEASURED 2026-08-14 and given a contract instead of a parenthetical. The row above is honest that the engine is not wired; nothing until now NAMED the wiring as work, so it could never appear on the hive queue. Measured over 23,073 files with coverage_complete=1: nx_eqsat.nx has exactly 10 importers and EVERY ONE is its own test, bench, proof or the superoptimizer -- nx_opt, nx_compile_x86, nx_x86_64 and nx_riscv import it ZERO times. So the estate owns a gated equality-saturation engine whose entire consumer set is its own test harness. WIRED 2026-08-23: nx_opt.nx now imports nx_opt_eqsat_pass.nx and opt_run calls opt_eqsat_pass beside opt_reassoc, LIVE (not behind a disabled constant). Witnessed in the shipping pipeline, not argued: compiling runtime/nx_eqsat_wire_probe.nx, ewp_xor_self (x ^ x, x a runtime param) emits movabsq $0 where the pre-LN8 compiler emitted xorq, and the control x ^ y keeps its xor; nx_opt_eqsat_wire_gate 5/5 GREEN on the promoted toolchain, RED 4/5 (exactly the fold tooth) on a mutant with the call removed, RED 2/5 on the pre-LN8 compiler; nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary GREEN; compile-time cost measured +26 ms on a 275-line gate and within noise on the 3.5 MB compiler unit; full-population local A/B over every top-level program shows default builds byte-identical except the rewritten sites. Added --ir-dump (per-invocation post-opt IR dump; the /tmp/nx_ir_dump marker was a host-global switch). RE-KEYED 2026-08-23: the watch organ is now runtime/nx_opt_eqsat_pass.nx, where opt_eqsat_pass is DECLARED. The board's honest ruler is a top-level func declaration (the rule nx_compare_rank applies); a call site in nx_opt.nx is not a declaration, so on nx_opt.nx this cell read LANDED on the page (the generator's substring probe) and OPEN to the ranker at the same time -- two rulers, one subject. Existence is the receipt; CONSUMPTION is the proof and it is nx_opt_eqsat_wire_gate above, not this flip. WATCHING opt_eqsat_pass. Still behind the equivalence net by design: nx_cc_equiv_gate 10/10 plus selfhost must pass before any optimizer change promotes. Adoption:* `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Energy measurement infra (RAPL) Measured: `ep_read` exists in `runtime/_hdl_build/nx_energy_probe.nx`, verified at emit. Probe reads energy_uj; zero measured Joules vs C yet (X-PERF-002 open) -- beat-C-on-energy is UNMEASURED Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Competitive native speed vs C Measured: `x86_use_regalloc` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. RE-MEASURED 2026-09-01 BY THE SOVEREIGN BENCHMARK ORGAN nx_lang_h2h AGAINST THE PROMOTED TOOLCHAIN (nx_cc_sovereign 778,655 B): identical bounds-checked hot loop, 7 runs per arm, every arm printing checksum 31447040000 -- NishiLang checked 7,152 us median vs gcc -O2 2,148 us = 3.33x (a second independent run 7,241 vs 2,093 = 3.46x); Rust -O checked 4,371 us = 2.03x; Go 4,196 us = 1.95x; clang -O2 1,128 us = 0.53x (it vectorises the loop gcc does not). The Aug-19 laptop copy of the compiler measured 8,508 us on the same host, so the LN7 register-allocation rung is worth 16 percent on this loop, reproduced. The receipt is knowledge/compare/lang.bench (host, every toolchain version, every source and binary sha256, min and median, the exact repro command), rendered on this page as the Measured head-to-head section and refereed by nx_lang_h2h_gate, whose reader re-derives the verdict from the rows. HONEST STANDING: NishiLang is NOT a peer of gcc or Rust on this loop yet -- 3.3x gcc -O2 and 1.6x Rust-checked -- and the rung that closes most of that gap is LR7 sound bounds-check elision (the UNCHECKED NishiLang lane measured 2.02x gcc on 2026-08-14). ROOT CAUSE SUPERSEDED 2026-08-14. This note used to blame a stack-machine backend with regalloc wired only into RISC-V. Re-measured on the CURRENT compiler with an identical bounds-checked hot loop where all arms must print the same checksum or the run is void: gcc -O2 2,270us, Rust -O checked 5,041, NishiLang checked 10,237, NishiLang UNCHECKED 4,581 -- so the unchecked lane lands within 9 percent of Rust CHECKED, i.e. the raw codegen is already at the checked-language tier. Then READING THE EMITTED ASSEMBLY moved the diagnosis again: the loop counter lives in r12 and the accumulator in r13 for the whole loop, so register allocation DEMONSTRABLY WORKED, and the emitter STILL spills both to stack homes on entry and reloads the counter twice more from a register that never changed. The dominant cost is not the check and not missing phi nodes: THE BACKEND DID NOT CONSUME THE REGISTER ALLOCATION IT ALREADY COMPUTED -- FIXED 2026-08-23 (x86_use_regalloc in runtime/nx_x86_64_ctx.nx): a homed value is now read IN PLACE as a compare/binop/SIB source operand instead of being copied to a scratch register first, and a load the allocator can forward no longer takes a home of its own -- forwarding is generalised across basic blocks under a SOUND cut-the-load-block availability check (an earlier merge-unsound draft that forwarded a stale value was caught by the self-host fixpoint and rewritten, not shipped). MEASURED on runtime/nx_probe_bchk_asm.nx: the loop counter is compared in place (movq %r12,%r15 ; cmpq $1024,%r15 -> cmpq $1024,%r12), main() 64->60 instructions (--no-crash-guard) / 62->58 (guarded), and nx_bounds_perf's checked hot loop 8278us -> 6912us median over 3 runs each (-16.5%). PROVEN: nx_x86_regalloc_use_gate 5/5 GREEN and 3/5 RED (T2,T3) against the banked pre-LN7 compiler; nx_cc_equiv_gate 10/10 + selfhost GREEN; LN1/LN2/LN3/LN8 gates still GREEN on the live compiler; promoted a21068ae both roots. witness-backed by runtime/nx_probe_bchk_asm.nx rather than argued. NOTE the two figures are DIFFERENT benchmarks against DIFFERENT baselines (3.65x was vs -O0 on the paired microbench and has not been re-run), so neither refutes the other. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads)	●	◉	◉	●	○
Call arity + param-type checking Measured: `prepass_count_params` exists in `runtime/nx_parse.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14: this row published _ABSENT_ for nine days AFTER the capability shipped, because a bare _ABSENT_ is a hand-written claim that nothing re-measures. COMPILER-ENFORCED and bite-proven live 2026-08-05 through /api/build with both the refuse and the accept direction witnessed in-tree (nx_probe_arity_live.nx, nx_probe_ptrint_live.nx): call-arity mismatch, pointer-into-integer argument types, and a duplicate-definition guard, with forward references carried by pre-registered stubs whose parameter table prepass_count_params builds. Integer literals stay exempt by design (the sentinel idiom) and fn-pointer calls remain unverifiable by name. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Match exhaustiveness checking Measured: `parse_stmt_match` exists in `runtime/nx_parse.nx`, verified at emit. SYMBOL RE-KEYED 2026-09-01: n_variants is a struct FIELD (nx_parse.nx:577), not a column-0 declaration, so the one symbol ruler read this row UNGROUNDED and the evidence referee went RED on it while the capability was shipped and proven; the enforcing code is parse_stmt_match, where the non-exhaustive and unreachable-arm refusals are emitted (nx_parse.nx:5301). STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-05. EnumEntry.n_variants (nx_parse.nx:577) is filled by the variant loop and parse_stmt_match counts DISTINCT discriminants, so duplicated arms cannot fake coverage. The refusal NAMES the enum and the MISSING variants, and a second check refuses an UNREACHABLE arm citing both lines. Elm ADTs remain the bar for the surrounding type system. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	○	◉
Memory safety (bounds, ownership, use-after-free) Measured: `own_check_move` exists in `runtime/nx_ownership.nx`, verified at emit. own_check_move SHIPPED 2026-08-25 as the --ownership DECLARED MODE and LIVE on the toolchain (778,655 B, canary GREEN): a use after __move(p) is a compile error naming the dead local AND the line its life ended on, stamped capability=own-check-move. THE WATCH STAYS OPEN DELIBERATELY, exactly as LN1 LN2 and LN3 do: the default is OFF and the contract is not discharged until the per-class ratchet flips it after a clean corpus census, so flipping this cell now would light green over a contract that is still open. THE MODE CANNOT CHANGE A DEFAULT BUILD, and that is measured rather than argued: it emits no IR at all, and the positive control compiles to byte-identical assembly under both modes at 67,374 bytes. PROOF: nx_ownership_gate 19 of 19 GREEN on the PROMOTED toolchain, 2 of 19 RED on the pre-rung builder, mutation bite valid_mutants 1 killed 1 not_reached 0 with the restore byte-verified. Its first six teeth are neg-controls establishing that the gap is REAL rather than assumed -- the hazard, the alias and the double-free all COMPILE AND RUN exit 0 under the default today -- and one of them is honest about WHY: the hazard runs clean by an arena accident, not by correctness, because 64 bytes is below NXA_SMALL_MAX so the release is a no-op. THE CONTROL FOUND TWO DEFECTS IN THE GATE ITSELF and both were fixed rather than accepted: the byte-neutrality tooth passed on two EMPTY asm files (two failures agreeing read as an equivalence, inside the tooth certifying neutrality), and the refusal tooth passed on a refusal the mode did not cause, since the old builder refuses __move merely as an unknown name. Rebinding both to their denominators moved the baseline 4 of 19 to 2 of 19 -- exactly those two stopped passing wrongly. Declared floors, each named: named locals only, no cross-function ownership, var aliases unswept, loop back-edges unmodelled, and conditional moves poison exactly as Rust does. Rust borrow checker is Best; Zig runtime safety modes; Go GC plus bounds checks. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	◐	●
Rich diagnostics in the shipping compiler (caret, did-you-mean, multi-error) Measured: `nx_diag_caret` exists in `runtime/nx_parse.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-05. The note this replaced said the caret and Levenshtein UX existed only in the retired C bootstrap, on the wrong side of the sovereignty boundary. It is sovereign now: nx_diag_caret plus bounded-Levenshtein did-you-mean over calls, bare identifiers AND type names, multi-error recovery across 12 semantic sites closed by a hard end gate, and the 5W-and-H voice on the undefined-name family. It stays SILENT when nothing is near, because a wrong suggestion is worse than none. Elm and rustc remain the bar on error codes and explain prose. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	●	◉
Closures / lambdas Measured: `parse_closure_capture` exists in `runtime/nx_parse.nx`, verified at emit. LANDED 2026-09-27 (lang LN13c): a function literal that reads names of the function around it is lowered by parse_closure_capture into a compiler-emitted environment (slot 0 the code address, slot k+1 the captured value) BY VALUE: the closure owns its copy, mutates it across its own calls, and the enclosing variable never moves; a captured pointer writes through. The literal value is TY_CLOSURE and a call through it loads slot 0 and passes the environment first; a struct or stack array captured by value, a static, and a func(...) annotation over a closure are refused by name. Proof: nx_closure_capture_gate 19/19 on the native and RV64 doors (tick=1,2,3 with outer=0, mk=42, the door checksum through a captured pointer), the wasm doors refuse it by name (no call_indirect arm: the LN13a table rung). Not yet: capture by reference or move (Rust borrow and move, Go shared variables), closures in func(...)-typed struct fields, closures on the wasm door, escape analysis. Rust Yes (Fn traits), Go Yes (shared by reference), Elm Yes (first class), Zig No (by design). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	○	●	●
Namespaces / qualified imports Measured: `imp_qualified_name` exists in `runtime/nx_import.nx`, verified at emit. File-import only; name collisions caught by lint not language (22 shadow collisions found 2026-06-23). WATCHING imp_qualified_name. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=48 nonval=46` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Language server / editor integration Measured: `lsp_serve` exists in `runtime/nx_lsp.nx`, verified at emit. SHIPPED 2026-08-25 (nx_lsp LIVE 436,114 B, registered, invoked). LSP 3.17 over stdio, framed Content-Length, served FROM THE COMPILER'S OWN FRONT END -- expand_imports plus LineMap, lex_source, parse_module -- and NEVER a second parser, which is the architecture bar rust-analyzer's own note sets and the thing that cannot be retrofitted later [matklad-ide]. Every diagnostic a user sees is the shipping caret and did-you-mean text VERBATIM, so the editor cannot disagree with the build. Analysis is fork-isolated because the parser sys_exit(2)s by design. It advertises ONLY textDocumentSync=Full, definitionProvider and hoverProvider: advertising a capability it does not serve would be the stub-carrying-the-contract-name defect, so completion, rename, references and incremental sync stay UNADVERTISED and rust-analyzer and gopls still lead there. A didChange carrying a range is REFUSED LOUDLY over window/logMessage rather than mis-applied as a full replacement. PROOF: nx_lsp_gate 19/19 GREEN on the live binary via /api/gate_run exit 0, mutation-bitten valid_mutants=1 killed=1 not_reached=0 with the twin restored and re-confirmed by hash; four neg-control teeth plus a bite-proven pairing cell that fires on bad input and stays silent on good, since either half alone is passable by a server that always, or never, reports. Measured: bad_diags=1 at line=2 character=17 against a DERIVED expectation, utf16_character=47 from byte_column=50 (so the wire really is UTF-16 as the protocol requires, not bytes), frames=6, server_exit=0. It extended nx_json_lib to one de-escaper with two contracts rather than forking it, because the incumbent flattened newlines and tabs to spaces for TSV safety and would have silently destroyed a document buffer. RESIDUAL NAMED: imports are read from disk, so an unsaved edit in one file is not seen while analysing another (no VFS overlay), and documentSymbol is deliberately not shipped though its index exists. IT ALSO FOUND A DEFECT IN THE COMPILER AND THAT FIX SHIPPED: nx_parse.nx wrote the function name to fd 2 for every function of every compile with no newline, gluing the first diagnostic of every build to it and taking this very gate to 13/19 RED with a perfect diagnostic sitting in the artifact -- removed 2026-08-25, measured at 62 to 82 percent of all compiler stderr. Adoption: `RUN-BY:fork:nx_lsp_gate` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Go (leads)	●	◉	●	◉	●
Canonical source formatter Measured: `srcfmt_emit` exists in `runtime/nx_srcfmt.nx`, verified at emit. SHIPPED 2026-08-23 -- nx_srcfmt (srcfmt_emit) formats over the tokenizer stream and REFUSES via a token-stream ORACLE any output whose tokens differ from the input, so it cannot change a program by construction. Style MEASURED from the whole corpus (18,561 files, 2.97M lines): 4-space indent, brace on the opening line, comma/semicolon/binary-operator spacing, struct field type columns aligned (1,340 of 1,712 multi-field runs), const and static single-space. Idempotent and build-neutral (formatted source compiles to byte-identical asm) proven over the tree; nx_srcfmt_gate 13/13 GREEN live, bite-proven both directions. Bars gofmt zig-fmt elm-format. WATCHING srcfmt_emit. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons behind Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	◉	●
Incremental compilation / build cache Measured: `inc_cache_lookup` exists in `runtime/nx_inc_compile.nx`, verified at emit. SHIPPED 2026-08-25 (nx_inc_compile LIVE 97,470 B, registered and authorised, but MEASURED INVOKED=NO by nx_catalog on 2026-09-06 so it reads REGISTERED-DARK; this note previously asserted an invocation no instrument can see, and the honest bound is that actlog watches the MCP surface only, so a direct fork would log the runner rather than this organ). Per-module cache keyed by the closure sha the build door ALREADY computes: it NEVER computes one of its own, it replays nx_closurehash's key and stores that ruler's per-file rows as the per-module table, so there is one key authority and not two. Proven by identity rather than assertion -- three recorded keys are byte-equal to /api/build's own closure_sha256 for the same targets, and gate tooth T8 re-forks the ruler and compares. The name-to-path resolver was EXTRACTED to nx_incclosure_lib and nx_closurehash now DELEGATES to it, so the cache cannot resolve a module differently from the ruler that hashed it (behaveprobe live-vs-staged IDENTICAL three times including the 78-file nx_mgmt_api closure). The member list is a deliberate SUPERSET of the ruler's closure -- it adds the crash guard and the compiler and assembler bytes, the inputs the ruler cannot see -- so it errs toward an EXTRA REBUILD and never toward a false hit. MEASURED ON THE REAL CORPUS, not a fixture: 6 targets over 18 modules and 47 member edges decided in 5 ms with ZERO forks and ZERO writes, against 9,274 ms to record five of them cold, about 4,600x on the decision; 47 member lookups served by 18 file reads (617 permil memoised); a warm 3-target build forks the builder ZERO times against 142 to 152 ms per fork when the incumbent cache serves the artifact and 773 ms for a genuine compile. Index is 2,548 B for 6 targets, bounded by a conf row with announced oldest-first eviction and a doubling growth window rather than a ceiling. PROOF: nx_inc_compile_gate 40/40 GREEN via /api/gate_run exit 0 on an isolated fixture tree with the incumbent cache DISABLED so it cannot serve the hit this rung is credited with -- byte-identity against a full build, a one-file edit rebuilding only its NAMED dependents while the non-dependent is provably never compiled, sibling invalidation (the subtlest false-hit class), corrupt-index refused whole, a toolchain axis where a compiler-byte change misses on unchanged sources, and four neg-controls; bite valid_mutants=1 killed=1 not_reached=0 with the restore byte-identical. TWO REAL DEFECTS FOUND BY RUNNING IT AND FIXED: a relative builder path could not survive the chdir and died execve 127, which read as the builder being missing and named the wrong subject; and the index fsync cost 27,107 ms of a 27,111 ms warm run on a loaded array, so the cache cost more than the builds it saved -- removed as a declared conf row with the arithmetic beside it, since the rename is atomic regardless and the loader refuses a corrupt index whole, taking the warm run to 64 ms. Every peer caches compilation and the anti-bar is the measured Rust adoption tax, so the decision path is fork-free by construction. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Debug info (DWARF .debug_line, statement granularity) Measured: `lm_stmt_stamp` exists in `runtime/nx_linemap.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-07. The note this replaced said emitted ELFs carry no source-line mapping. Opt-in via -g: lm_stmt_stamp records (address, file, line) OUT OF BAND keyed by instruction pointer (struct Instr was not widened), nxasm encodes the line program, and GNU readelf resolves the same addresses so third-party gdb and addr2line interop is real rather than asserted. MEASURED AT CORPUS SCALE, not on a fixture: 11,121 of 11,379 files built, 1,725,477 functions, 18,835,389 rows, ZERO per-file regressions. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=10 nonval=10` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	◐
Stepping debugger and .debug_info (types, variables, breakpoints) Measured: `dbg_step_over` exists in `runtime/nx_dbg_step.nx`, verified at emit. STATEMENT STEPPING SHIPPED 2026-08-25, gate-proven on the LIVE binary: nx_dbg_step_gate 29 of 29 GREEN via /api/gate_run exit 0 (re-run independently), mutation bite valid_mutants=1 killed=1 not_reached=0, restore byte-verified. Built ON LB5's line table, not a second one: it composes nx_addr2line_lib's DWARF v5 primitives and adds the two directions a debugger needs that nx_a2l_run structurally cannot give -- file:line to ADDRESS for breakpoints, and the whole row table across ALL sequences, where the incumbent keeps one row and stops at the first end_sequence. It also decodes special opcodes, const_add_pc, fixed_advance_pc and any standard opcode via the header's own standard_opcode_lengths, so the table reads third-party DWARF v5 and not only our emitter's subset; an incompletely decoded table answers UNPROVEN, never no-such-line. Proven on a runtime-assembled RV64 fixture carrying a real linking JAL, over a .debug_line emitted by our own nx_dwarf_line: breakpoint by FILE and LINE resolved to 0x80000008 and HIT, step INTO reported callee line 100, step OVER reported caller line 13 at 0x8000000c with depth back to 0 and NEVER the callee line -- the one behaviour separating a statement stepper from an instruction stepper, asserted from the same starting pc. Call depth follows the RISC-V spec's own return-address-stack hint rules, x5 alternate link register and RVC C.JALR and C.JR included, not a rd-equals-ra guess. NEVER-BRICK IS STRUCTURAL, NOT PROMISED: func sys_ptrace is ABSENT-PROVEN estate-wide (matches=0 coverage_complete=1 corpus_complete=1) so no host process is reachable, the grammar has no pid and a pid-shaped argument is refused bite-proven, breakpoints are a bitmap so guest code is never patched and code_bytes_unchanged=1 is MEASURED every run, and detach is an in-process resume that runs even when the script never asks (auto=1, guest exit 5 matching the debugger-free reference sim). SCOPE, because this row was split in 2026-08-14 precisely so it would name its failing conjunct: the STEPPING half is LANDED; the .debug_info half is FUNCTION NAMES ONLY (DW_TAG_subprogram, wired for frame naming) and TYPES and VARIABLES remain ABSENT -- the shipped decoder understands only DW_FORM_addr and DW_FORM_string and refuses every other form, so DW_TAG_variable and DW_AT_location are unreachable today; the EMIT side was not measured and is not claimed either way. Backtrace is 2 frames (pc plus link register) and prints deeper_frames=UNWALKED rather than inventing callers. Execution surface is the sovereign RV64 interpreter: nxasm_rv64 is ABSENT-PROVEN so there is no RV64 compiler backend, and our .debug_line is emitted by the x86-64 assembler, so stepping a NATIVELY-executing nx_cc binary still needs an x86 interpreter or ptrace, and ptrace is refused on never-brick grounds rather than taken silently. gdb-on-C stays the bar. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_dbg_step_gate` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Free multi-line expressions Measured: `tok_line_continuation` exists in `runtime/nx_lex_kinds.nx`, verified at emit. SHIPPED 2026-08-25 and LIVE ON THE TOOLCHAIN (buildroot/_offc/nx_cc_sovereign.elf 738,558 B, promote canary GREEN). A continuation line opening with a binary operator now JOINS the expression above it. ORGAN PATH RE-KEYED to nx_lex_kinds.nx, where tok_line_continuation is DECLARED: that file already declares itself the shared home for exactly this (lex.nx and parse.nx used to carry local copies of the Tok layout and now share one), so the predicate costs no new import edge and there is only ever ONE of it. at_stmt_boundary already relaxed fifteen always-binary kinds in 2026-05-16; the residual was the four it called ambiguous. Three of them are not: NishiLang has exactly ONE operator-led statement form (parse_stmt_star, the pointer store), so no statement begins with plus, minus or ampersand and at statement level they can only ever have been a continuation. TK_STAR is the one true ambiguity and is decided by sb_star_starts_store, which looks for the store's assign at bracket depth 0 BOUNDED BY THE PHYSICAL LINE rather than by a chosen constant. THE SAFETY ARGUMENT IS CHECKABLE, NOT ASSERTED: the programs this reclassifies are exactly the programs that DO NOT BUILD TODAY, because the 2026-08-13 discarded-pure-expression refusal already rejects them -- so joining them cannot change the meaning of any program that compiles. Proven by the baseline half of the bite: the pre-LN15 compiler fails all four join cases with build=1, i.e. by REFUSING them. PROOF: nx_linecont_gate 10/10 GREEN on the promoted toolchain and 5/10 RED on the banked pre-LN15 compiler, the same gate binary against two real compilers rather than a synthesised mutant, with only the four capability teeth moving; nx_cc_equiv_gate rows=10 passed=10 selfhost=1 tree_moved_rows=0 GREEN with every row byte-identical (ea equals eb) and the self-host fixpoint at 738,558; nx_contentdiff GREEN 0 lost runs against BOTH live artifacts; nx_stale_check rebuild reproduces the staged bytes exactly with capability_check=OK. The gate carries a POSITIVE CONTROL and earned it: its first run was RED with even an ordinary one-line program failing exit 127, which was NAS /tmp being noexec and not a language fault -- four of its teeth are satisfied by a refusal, so without a tooth that must simply work an environment fault would have been published as a verdict about the language. Same edit removed twenty-odd bare token NUMBERS from at_stmt_boundary (if k == 56 beside TK_PIPE in the lexer is one constant written twice) and, separately, two stray sys_write(2) calls in parse_function that emitted the function name for EVERY function of EVERY compile with no newline, gluing the first real diagnostic of every build onto the last function name: measured at 62 to 82 percent of compiler stderr across the equivalence corpus. Every peer parses free layout; the det2x2 defect of 2026-07-09 was this class before the refusal existed. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=77 nonval=74` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Working floating point (f64) Measured: `x86ctx_emit_f64` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. SHIPPED 2026-08-25 and LIVE ON THE TOOLCHAIN (buildroot/_offc/nx_cc_sovereign.elf 778,655 B, promote canary GREEN). The board's own done-rule now passes: runtime/nx_probe_float.nx compiles and exits ZERO, where it exited 1 on 2026-07-09. SYMBOL RE-KEYED, and deliberately NOT by renaming code: the watch named x86_emit_f64_binop, which is ABSENT-PROVEN across the corpus at corpus_complete 1 -- no such function was ever written. Creating one to light the cell would be the stub-carrying-the-contract-name defect this board warns about, so the row now names the function that HONESTLY declares the capability, x86ctx_emit_f64 at nx_x86_64_ctx.nx line 2472, with x86ctx_emit_f64_ordkey beside it for ordering. PROOF: nx_f64_gate 25 of 25 GREEN on the promoted toolchain, and its expectations are DERIVED from an independent software IEEE-754 oracle (nx_f64_oracle_sov, anchored on 1217 hardware KATs) rather than hand-typed -- add sub mul div agree BIT FOR BIT, exactly on representable results and under round-to-nearest-even where they are not: 2^53+1 rounds back to 2^53, 2^54-1 needs 54 significand bits, the square of 2^27+1 needs 55, and 1.0/3.0 fills all 52 stored bits. Ordering was wrong for NEGATIVE doubles and is now right: a signed-integer compare of the bit patterns says -1.0 is less than -2.0 and IEEE says it is not, and the gate carries that exact pair as a neg-control so the tooth sits precisely where integer compare fails. THE SHARED-BACKEND RISK IS MEASURED, NOT ARGUED: f64 rides the same emitter integer code uses, so the gate compiles one integer source with the subject and with a REFERENCE compiler and byte-compares the emitted assembly -- 30,546 bytes both, identical 1. Without that reference the axis reported UNOBSERVABLE and the whole gate returned SKIP rather than a pass it had not earned; supplying the reference is what turned it GREEN. The incumbent nx_f64_adversary could not have caught any of this: it is a DECIMAL instrument with six hand-typed truncated constants, all non-negative, so it cannot see a one-ulp error and cannot see an inverted negative compare, which is why it ran green over this defect since 2026-07-16. This is a CORRECTNESS fix so the language is not silently wrong when someone writes f64; it does NOT make float a recommended path and does not weaken the integer-deterministic no-float doctrine, which remains this board's exceed. NaN unorderedness is a declared residual. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Bounds-checked TYPED array access, [N]T and []T (CWE-787 and CWE-125 class) Measured: `NX_BOUNDS_CHECK_LIVE` exists in `runtime/nx_parse.nx`, verified at emit. SPLIT OUT AND CORRECTED 2026-08-14. The single row this replaced said flatly that out-of-bounds is unprevented, which merged a SHIPPED half with an ABSENT half. Typed array access IS checked and the checks are LIVE, not compiled out: NX_BOUNDS_CHECK_LIVE (nx_parse.nx:1352) is the kill switch and emit_bounds_check injects against it, trapping NX_TRAP_BOUNDS. The cost is MEASURED, not modelled -- nx_bounds_perf.nx runs the same loop both ways and the check costs 2.23x on a bounds-checked accumulate loop (checked 10,237us vs unchecked 4,581us). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	●	●
Raw-pointer access prevented (CWE-787 and CWE-125, the unchecked half) Measured: `bck_ptr_provenance` exists in `runtime/nx_boundscheck.nx`, verified at emit. SHIPPED 2026-08-19 as the --ptrprov DECLARED MODE: a let-bound sys_mmap(const) pointer is bounds-checked like a typed array on read AND write legs, and a provably-out-of-range constant index is refused at compile time. Proof: nx_boundscheck_gate 11/11 GREEN on the shipped toolchain and 7/11 RED on the pre-LN3 baseline (bite-proven both directions); nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary 8/8. Default stays OFF (corpus byte-identical by construction) until the per-class ratchet flips it after a clean corpus census; runtime-sized allocations and var pointers are the named residual. The 2026-07-08 READ-TO-NUL over-read was this class in the wild and is the gate's fixture. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	●	●
Use-after-free prevented (CWE-416 class) Measured: `own_check_uaf` exists in `runtime/nx_ownership.nx`, verified at emit. own_check_uaf SHIPPED 2026-08-25 in the SAME checker as LN4 and LIVE on the toolchain: after sys_munmap(p, n) any read of p is a compile error naming the local and the release line, stamped capability=own-check-uaf. A DOUBLE FREE falls out of that ONE rule rather than needing a second, because the second release must READ the name in order to pass it -- so CWE-415 is covered by construction and its refusal correctly stamps own-check-uaf and not a separate rule. THE WATCH STAYS OPEN DELIBERATELY: default OFF until the per-class ratchet flips it, same as LN1 LN2 LN3 and LN4. THIS ROW'S OWN PREMISE WAS MEASURED AND IS FALSE AS IT WAS WRITTEN. The arena no-free doctrine does not hold because nothing frees: sys_munmap has ONE definition and 1,431 REFERENCE SITES at corpus_complete 1, while nxa_reset and nxa_free are ABSENT-PROVEN. What makes the doctrine FEEL true is sys_munmap's own body, which returns early when len is at or below NXA_SMALL_MAX, currently 256 -- so a small release is an arena no-op today and a use-after-free is invisible at runtime. The checker refuses BOTH sizes deliberately rather than keying a memory-safety rule on an allocator constant, because that constant has already moved once (256 to 128) and keying on it would silently un-refuse a whole class the day it moves again. PROOF: 19 of 19 GREEN on the promoted toolchain against 2 of 19 on the pre-rung builder, including an ALIAS fixture where the freed buffer is read through a SECOND name -- a checker that marked only the name inside the sys_munmap call would report nothing at all there -- and a double-free fixture that compiles and runs exit 0 under the default today. Rust borrow checker is the bar. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Go (leads), Elm (leads)	●	◉	●	◉	◉
Integer overflow checked (CWE-190 class) Measured: `chk_add_overflow` exists in `runtime/nx_checked_arith.nx`, verified at emit. STALE CLAIM CORRECTED 2026-08-14: this note used to say an immediate shift over 31 blanks the emitted .s (2026-07-06). That was measured FALSE -- it compiles and returns the MASKED value, which is worse, because a silent wrong answer beats a visibly empty one at hiding. FIRST RUNG SHIPPED 2026-08-13 and gated (nx_probe_ub_shift.nx, nx_langdiag_gate row): a CONSTANT shift count outside the result width is now REFUSED at compile time naming the legal range and stamping capability=shift-count-range. SHIPPED 2026-08-23 as the --chkarith DECLARED MODE (the LN3 shape): every i64 + - * is followed by an overflow check that traps exit 72 (NX_TRAP_OVERFLOW) instead of wrapping; a constant overflow in source is REFUSED at parse time naming the rule; __wrap_add/__wrap_sub/__wrap_mul are the exempt wrap-by-intent forms (the Zig +% / Rust wrapping_* contract), so hashes keep building once the mode flips. Proof: nx_chkarith_gate 17/17 GREEN on the promoted toolchain and 9/17 RED against the banked pre-LN1 compiler (exactly the eight mode teeth fail -- bite-proven both directions on the NAS and the laptop); nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary GREEN; default builds byte-identical by construction (full-population local A/B sweep over every top-level program, not a sample). Default stays OFF until the per-class ratchet flips it after a clean corpus census -- the residual is the i32 lane (declared mod-2^32 semantics) and runtime shift counts. WATCHING chk_add_overflow. Zig safe-mode and Swift trap-by-default lead; Go wraps by definition. [regehr-ub] Adoption: `FIXTURE` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Go, Elm; fully adopted on the estate ladderCons behind Zig (leads)	●	◐	◉	○	◐
Null and sentinel-zero deref prevented (CWE-476 class) Measured: `opt_enforce_unwrap` exists in `runtime/nx_option_enforce.nx`, verified at emit. Sentinel-zero-as-null is our recurring P2 meta-class; Option and Result EXIST in the stdlib but nothing enforces their use, so they are a convention wearing the shape of a type system. Elm ships no null at all. SHIPPED 2026-08-23 as the --optenforce DECLARED MODE (the LN3/LN1 shape): a dereference of a pointer-typed LOCAL not proven non-null on its path is REFUSED at parse time naming the local and the fix (capability=option-enforce-unwrap). Proof comes from the idioms this corpus already writes -- `if p != 0 {` (then-block), the early-exit `if p == 0 { return/break/continue/sys_exit }` (rest of the block), `if p == 0 {} else {` (else-block), `while p != 0 {` (body), nx_assert_ptr(p ...) -- and a reassignment re-derives the bit from the new value, so a stale check does not survive `p = call()`. DECLARED FLOORS, each one measured against the stdlib rather than chosen: parameters are trusted (the callee's contract; no nullable annotation exists yet), module statics are trusted (initialisation order is not modelled), sys_mmap results are non-null by the allocator's own contract (nxa_die on failure), integer-to-pointer casts and computed addresses are trusted, and chained derefs through loaded fields or call results (`a.b.c`, `f().x`) are not named locals and are not checked -- bind them to a local first, the estate's idiom. Proof: nx_optenforce_gate 14/14 GREEN (hazard nx_option_enforce.nx refused at `p.val`, the reassign witness refused after `p = call()`, the positive control nx_option_enforce_ok.nx with all nine idioms compiles AND runs under the mode, the mode emits no IR so the control's asm is byte-identical default vs mode) and 9/14 RED against the pre-LN2 compiler (exactly the five mode teeth); nx_cc_equiv_gate 10/10 plus selfhost GREEN; default builds byte-identical (nothing emits unless the flag is on). Default stays OFF until the per-class ratchet flips it after a clean corpus census. WATCHING opt_enforce_unwrap. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads), Elm (leads)	●	◉	◉	◐	◉
Data-race prevention (CWE-362 class) Measured: `sync_send_check` exists in `runtime/nx_parse.nx`, verified at emit. Thread pool is real (7x measured) but there is no Send-Sync-class typing; Go ships a runtime race detector, Rust and Swift 6 enforce at compile time. WATCHING sync_send_check. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	○	◐	●
Living bug-class ledger wired to language evolution Measured: `Bug Taxonomy` exists in `docs/BUG_TAXONOMY.md`, verified at emit. F1-F16 taxonomy + P1-P10 meta-patterns + the nx_cc trap register drive make-it-unrepresentable rungs; peers have public bug trackers (the dumps we bank) but not a ledger wired to language change rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. not adopted: no source and no binary: this is a build contract, not a partial deploy Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: no source and no binary: this is a build contract, not a partial deploy	●	◐	◐	◐	◐
Sovereign whole-stack toolchain (language compiler assembler runtime -- zero LLVM GCC libc beneath) Source present; authored stronger claim: `func main(argc` in `runtime/nx_compile_x86.nx`, verified at emit. The entire chain nx_cc to nxasm_x86 to ELF is ours bits-up and compiles on the NAS over the mgmt API (build-over-API GREEN 2026-07-06); Rust and Zig sit on LLVM; Go owns its backend but links foreign substrate below rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTRY-MISPOINTED` — PARTIAL: the organ is present but its registered path does not stat: re-register it at a path that exists. dossiernot adopted: the organ is present but its registered path does not stat: re-register it at a path that exists Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, ElmCons not adopted yet: the organ is present but its registered path does not stat: re-register it at a path that exists	◉	○	○	◐	○
Integer-deterministic no-float doctrine (cross-platform bit-exact by construction) Source present; authored stronger claim: `qmul` in `runtime/nx_nofloat_llm.nx`, verified at emit. A 100 percent integer LLM greedy-matches the float reference 4-for-4 (ledger AHEAD, 2026-07-09); gate-grounded across the codec and compute censuses; no peer ships float-free determinism as language doctrine Adoption: `LIB-WIRED importers=34 nonval=8` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Errors as values with enforced propagation (the Midori model) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `res_propagate_op`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ADMITTED 2026-08-19 from the 4-lane research sweep. Option and Result exist in the stdlib unenforced -- a convention wearing the shape of a type system. The Midori split is the bar: typed recoverable errors in signatures plus fail-fast abandonment, with one-character propagation so checking never rots into boilerplate [midori-errors]. Go proved in 2025 that this cannot be retrofitted once a community standardizes on the boilerplate [go-errsyntax]. WATCHING res_propagate_op: a dropped Result refuses (must-use) and a propagation form rethrows with context. dossierwatching res_propagate_op Pros none measured yetCons behind Rust (leads), Zig (leads), Go, Elm (leads); open contract; expected source declaration not established	○	◉	◉	◐	◉
Structured concurrency (scoped spawn, no orphan tasks) Measured: `sc_scope_spawn` exists in `runtime/nx_thread_pool.nx`, verified at emit. LANDED 2026-08-25 against the research floor of spawning only inside a scope that joins its children [njs-nursery]. Within the scoped API the orphan shape is UNREPRESENTABLE: join is the only exit, sc_scope_free REFUSES an unjoined scope, spawn into a joined one refuses by name, double-join refuses -- there is no verb sequence that ends a scope without joining it. A child error propagates to the scope, NAMES WHICH CHILD, and cancels that scope; cancellation is scoped by construction because the flag lives in the scope header. COLORLESSNESS PRESERVED, the trap named by the colored-function essay still not taken [nystrom-colors]: a child is a plain func of i64 to i64 and all 48 nx_pool_submit call sites are byte-for-byte unchanged (full-population census, 23,257 files, coverage_complete=1, partition 35 production plus 11 gate plus 1 definition plus 1 comment reconciling to 48). BEYOND RUST SCOPED THREADS AND GO ERRGROUP, WHICH ARE LIBRARIES SITTING BESIDE A BARE SPAWN: sc_strict_set(1) makes the BARE nx_pool_submit refuse SC_REFUSE_UNSCOPED, asserted on pool STATE (tasks_submitted unchanged 52 to 52) and not on the message, so the only route into the pool becomes a scope that joins it. It SHIPS OFF because 35 production call sites still use bare submit, so the honest word is ENFORCEABLE NOT YET ENFORCED, and it is NOT the compile-time law: NishiLang has no lifetimes or regions and the compiler was not touched, so Rust remains stronger on that axis. PROOF: nx_sc_scope_gate 35/35 GREEN via /api/gate_run exit 0 twice independently; pool witness nx_pool_ring_gate 6/6 GREEN over 70,000 tasks with the shared counter exactly right and all workers exited; bite valid_mutants=1 killed=1 not_reached=0 with the pool source restored byte-identical, honestly declared as a mutation floor of one and killed by TIMEOUT rather than by an emitted RED. SPEEDUP RE-MEASURED RATHER THAN CITED, AND THE OLD FIGURE IS CORRECTED: 3.0 to 3.9x on 8 cpus at load 9.7 to 14.1 across three runs, with the scoped form never slower than bare; the July 7x was a quiet box and is not reproducible under real load, so the floor was ratcheted to 3000 permil guarded by an IN-RUN control requiring the incumbent bare arm to clear the same floor, because a load-based bar on a host that sits at 14 to 21 would be permanently SKIP, the detector nobody reads. ENVELOPE MEASURED: 41,056 B per scope in ONE mmap and one VMA, 40 B per spawn inside that existing mapping with zero extra syscalls, join allocates nothing, and live bytes go 0 to 41,056 to 0 after join and free. Join bounds are DERIVED from nx_pool_wait because a scope child IS a pool task, with the conf deliberately carrying NO row and two teeth checking that linkage mechanically so it cannot be silently unpinned. Zig dropped async pending redesign; Elm has no threads. Adoption: `LIB-WIRED importers=46 nonval=27` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	○	◐	○
Supply chain by construction (no install scripts, content-addressed, no registry attack surface) Measured: `pkg_cas_resolve` exists in `runtime/_hdl_build/nx_pkg.nx`, verified at emit. LANDED 2026-08-25. The 2025 registry worms exploited install-time code execution and blind version trust [tob-supply2025]; this lane removes both. pkg_cas_resolve is live in nx_pkg (63,205 B promoted, registered, invoked) and gate-proven by nx_pkg_gate 19 of 19 GREEN via /api/gate_run exit 0. ORGAN PATH RE-KEYED to _hdl_build, where nx_pkg is DECLARED: runtime/nx_pkg.nx never existed, so the old path could never have measured anything, and nx_pkg already carried a byte-sum demo that was EXTENDED rather than duplicated (nx_presubmit BLOCKED the dual copy). A module resolves by sha256 digest -- the same digest nx_filehash and nx_closurehash use, agreement proven twice -- with no name lookup at the digest layer, so there is no version negotiation and no latest to poison. The store path is a hint and the hash is the identity: bytes substituted at the legitimate digest path refuse digest-mismatch, bite-proven against a restore that resolves. A lookalike name refuses name-not-pinned at exit 9 and writes no file, while the legitimately pinned name resolves at exit 0 as the positive control -- a guard that refused everything would fail there. Zero install-time execution is proven mechanically, not asserted: a module carrying a working install hook RESOLVES SUCCESSFULLY and the hook side effect is ABSENT, the hook having first been shown to fire when executed; static corroboration ABSENT-PROVEN for sys_execve, sys_fork and sys_clone at corpus_complete 1. Two mutants were killed, one disabling the re-hash and one disabling the unpinned refusal, the second earning its keep by proving the suite asserts WHICH rule fired -- the typosquat was still refused, for the wrong reason. Transparency is a hash-chained journal that refuses to extend a broken chain: tamper-evident against a partial edit but NOT sumdb equivalent -- one writer, unsigned, unwitnessed, no inclusion proofs -- which is why exceed stays 0 rather than claiming a clean win. Residual named in source: pin time is the trust boundary, a whole-journal rewrite verifies, no signature layer is wired, and the compiler import path still resolves by filesystem name. Adoption: `RUN-BY:fork:nx_pkg_gate` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Elm; fully adopted on the estate ladderCons behind Go (leads)	●	◐	◐	◉	◐
Language-level capability security (no ambient authority) Open — watching `runtime/nx_caplang.nx` : `cap_root_main`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. ADMITTED 2026-08-19. No mainstream language ships it -- any transitively imported function can open any file or socket, which is the root of supply-chain risk. Austral and Pony prove the design: authority is a value handed to main, and a dependency signature IS its permission manifest [austral-caps]. The estate ops surface is already ocap (attenuate-only, live-proven); this watch extends it into the type system. Honest greenfield: nx_caplang.nx does not exist. WATCHING cap_root_main. dossierwatching cap_root_main Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Written language specification + conformance suite Measured: `spec_conformance_run` exists in `runtime/nx_langspec.nx`, verified at emit. SHIPPED 2026-08-25, taking the Ferrocene lesson early rather than retrofitting a spec years after 1.0 [ferrocene]. nx_langspec LIVE 51,172 B registered and invoked; nx_langspec_gate 30 of 30 GREEN via /api/gate_run exit 0 (re-run independently), mutation-bitten valid_mutants=1 not_reached=0 killed=1 with the twin restored byte-identical. The specification is DATA (33 clauses in knowledge/specs/nishilang.spec) and so is the suite (35 cases), so every case cites the clause IDs it exercises and traceability is resolved MECHANICALLY rather than asserted -- which is the thing a hand-coded row list structurally cannot have. Full production run over the SHIPPED compiler: 35 pass, 0 fail, 0 unobservable, both partitions reconciling, 33 of 33 clauses exercised at 1000 permil against a declared ratchet raised 800 to 1000 after the gain, unresolved citations 0. Three states never two: a case the runner cannot judge is UNOBSERVABLE and folds into neither pass nor fail. The load-bearing tooth is the planted deviation and it is proven in BOTH directions: a clause and the compiler made to disagree exits DEVIATION naming the case and the reason; a refusal for the WRONG reason is also a DEVIATION, so a suite that only asks whether the program was refused cannot pass here; an empty suite exits EMPTY and can never be success, the vacuous-test defect wearing a certification costume; and an ABSENT compiler ABSTAINS at exit 3, which is what proves the runner really forks the shipped compiler instead of simulating it. It composes nx_ccgate_lib rather than adding a second compiler driver, extending it additively with a compile-only verb because the incumbent collapsed every failure to 1 and made the refusal-exit clause untestable. FIRST RUN FOUND A REAL GAP AND THE SPEC REFUSES TO LAUNDER IT: the integer-literal-range rule is written in nx_parse.nx and ABSENT-PROVEN from the shipped toolchain binary (positive control: the sibling shift-count-range capability IS present in the same binary, so the scanner reads binary content), so three out-of-range literals are accepted today. Filed as debt 1787687118 and deliberately NOT specified until it ships -- specifying the defect as intended would launder it, and a permanent RED is a detector everyone learns to ignore. Go's spec remains the field's best; Zig has none. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, ElmCons behind Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◐	○	◉	○
Safety ring inherited by NishiOS + Nishi Browser (the Rule-of-2 discharge) Source present; authored stronger claim: `oa_state_name` in `runtime/nx_osattest.nx`, verified at emit. SHIPPED 2026-08-25. Chromium forbids combining untrustworthy input, an unsafe language and high privilege, and the incumbents discharge it by SANDBOXING AROUND their language [rule-of-2]; a kernel-up single-language stack discharges the unsafe-language leg everywhere. nx_osattest is LIVE at 68,288 B, registered and invoked, with nx_osattest_gate 24 of 24 GREEN via /api/gate_run exit 0 (re-run independently after the lane that built it was killed mid-flight -- an organ found promoted is run, never trusted). SYMBOL RE-KEYED HONESTLY: the watch named nxos_lang_ring_attest, which is ABSENT-PROVEN across the corpus at corpus_complete 1 -- no function of that name was ever written, the capability lives in the organ itself. Renaming code to match the contract would be the stub-carrying-the-contract-name defect, so the row now names oa_state_name, which is distinctive to this organ and whose existence IS the capability: it declares the six attestation states. THE ORGAN REFUSES A SILENT DEFAULT COMPILER BY DESIGN -- with no argument it exits usage rather than attesting, because a default produces a fully-formed verdict about whatever binary happened to be lying there. The gate is built out of the states rather than a score: the partition SUMS to its declared population, a planted source that must be refused is counted refused AND the refusal NAMES the declared rule rather than merely being a refusal, and a clean source is still counted ATTESTED as the positive control, which is what stops an attester that refuses everything scoring perfectly. UNOBSERVABLE IS A REAL THIRD STATE AND IS PROVEN THREE WAYS: a real-looking flag the compiler silently ignores is reported UNOBSERVABLE with that exact reason and is counted neither clean nor refused nor quietly dropped, and a rung with no compiler flag at all reports flag-undeclared, a DIFFERENT reason. The denominator travels with the score and the missing modes are NAMED. An absent subject exits UNPROVEN into its own bucket and the canonical last line reads RED, because a confident attestation over a subject that is not there is the worst outcome available to this organ. An empty population is REFUSED, never reported as a clean sweep. Rust holds Part via Rust-for-Linux and Servo. Adoption: `RUN-BY:fork:nx_osattest_gate` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	○	○	○
Sound bounds-check elision (checked speed at unchecked cost) Measured: `bck_elide_dominated` exists in `runtime/nx_bck_elide.nx`, verified at emit. ADMITTED 2026-08-19. The bounds check costs a measured 2.23x on the accumulate loop (checked 10237 us vs unchecked 4581 us) while peers elide dominated re-checks in their optimizers. An UNSOUND elision is a silent memory-safety hole, so every elision must ride the blessed dominance oracle and the elision proof gate is the tooth. WATCHING bck_elide_dominated. MEASURED 2026-08-31 and the contract is DELIBERATELY HELD OPEN because the pass is WRITTEN and GATE-PROVEN but NOT IN THE SHIPPED COMPILER. Field 2 of this row is a KNOWN-WRONG POINTER kept on purpose: bck_elide_dominated is declared at runtime/nx_bck_elide.nx:444 and called at runtime/nx_opt.nx:2627 inside opt_bounds_check_elim, which the opt round calls at nx_opt.nx:3957 behind the --bckelide declared mode, and nx_opt.nx:28 imports the file so it IS in the compiler build closure; runtime/nx_boundscheck.nx carries only a comment plus the DISTINCT symbol bck_elide_dominated_witness (nx_absent over buildroot/runtime, 8 matches, coverage_complete=1 corpus_complete=1). ONE gate, two compilers, same box same minute: nx_bck_elide_gate against the LIVE promoted nx_compile_x86.elf (737605 B) is 10 of 13 RED with the dominated assembly BYTE-IDENTICAL under the flag (32063 vs 32063, so the flag is inert), and against the unpromoted buildroot/_build/nx_compile_x86.sov.elf (778679 B) is 13 of 13 GREEN with the dominated assembly falling 32063 to 31411, the non-dominated case still byte-identical and both out-of-bounds legs still trapping 71. So the live toolchain provably lacks LN7 elision and the single outstanding action is a toolchain promote of nx_compile_x86 -- written, compiled, not promoted. DO NOT repoint field 2 at runtime/nx_bck_elide.nx on its own: wp_classify in nx_swcompare_lib returns ONLY LANDED or WATCHING for an _ABSENT_ row, so repointing alone would flip this cell LANDED over a capability the shipped compiler does not have. Repoint it in the SAME change that lands the promote. LN7 is PARTLY shipped: nx_x86_regalloc_use_gate is 5 of 5 GREEN on the live compiler, so the backend regalloc half is in and only the elision half is missing. RE-DERIVED 2026-09-03 AND THE PARAGRAPH ABOVE IS NOW STALE IN THE PESSIMISTIC DIRECTION: the toolchain promote it names as the single outstanding action HAS ALREADY LANDED (live nx_compile_x86.elf is 923280 B, not the 737605 B measured on 08-31), and nx_bck_elide_gate run against THAT LIVE PROMOTED COMPILER is 13/13 GREEN -- elision proven dominance-gated, both out-of-bounds legs still trapping 71, the non-vacuity tooth confirming both legs already trap WITHOUT the flag, and the elided program still computing the closed form both under and without the flag. MEASURED BY THE GATE, NOT ASSERTED BY HAND: h2h_A2_divfree_checked_no_elision_us=41266 against with_elision_us=20711, a 1.99x win on the div-free checked accumulate loop. Field 2 is REPOINTED at runtime/nx_bck_elide.nx in this same change, exactly as the paragraph above instructs, because the capability is now IN THE SHIPPED COMPILER and the cell may flip honestly. ONE REGRESSION IS OPEN AND DELIBERATELY NOT HIDDEN: on the modulo arm the same gate reads h2h_A_modulo_checked_no_elision_us=102547 against with_elision_us=112529, so elision COSTS about 9.7 percent on that shape; the gate publishes that ratio and gates nothing, so no instrument in the estate would have caught it. LESSON: a matrix note that hand-asserts what the SHIPPED BINARY can do rots silently and in the flattering-to-nobody direction -- two rungs on this board (LR7 and LN18) were both understated today, and each cost a full investigation to re-derive. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads), Go (leads)	●	◉	◉	◉	○
Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop) Measured: `bck_elide_induction` exists in `runtime/nx_bck_elide.nx`, verified at emit. LN7b SHIPPED TO SOURCE 2026-09-01, gate nx_bck_iv_gate 20/20 GREEN on the candidate compiler (F1 both loop checks elided and the program still computes its closed form 88; F2 a guard wider than the array KEPT and trapping 71; F3 a non-constant step KEPT; F4 a reset on the guard-to-access path KEPT and trapping; F5 a counter whose address escapes KEPT and trapping; --mode=f1 byte-identical to --bckelide; an undeclared mode REFUSES). The proof is the one the dominance pass (LR7) structurally cannot see: the loop-header compare LT_S(LOAD(k), L) with L not above the array length, k a non-escaping local whose every store is a constant reset or a guarded constant-step increment, and no store to k on any guard-to-access path. Lower bound follows from a zero or positive reset and non-negative steps that cannot wrap before the guard fails. MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. Peers: LLVM elides these via SCEV range analysis and IRCE loop splitting [llvm-irce], Go via its prove pass carrying Limit{Min,Max,Umin,Umax} lattices per value [go-prove]; Zig rides LLVM in its release modes. Elm has no bounds-checked array indexing to elide. Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Go (leads)	●	◉	●	◉	○
Compiler modes as declared data (daily, f1, drag, checked, small) Measured: `nxcx_expand_mode` exists in `runtime/nx_compile_x86.nx`, verified at emit. SHIPPED TO SOURCE 2026-09-01. A mode is a NAMED BUNDLE of flags the driver already parses, declared in knowledge/lang_modes.conf (four pipe-separated fields: mode, name, flags, intent) and expanded before the ordinary argv loop, so a mode can never do anything a hand-typed flag list could not; an undeclared mode or a missing conf REFUSES the build with exit 9 naming the rule (a silent default is a mode wearing the wrong name). Operator framing 2026-09-01: real speed like an F1 car and a daily driver, not a drag race -- daily = every safety mode ON with proven elision and the line table; f1 = checks live with sound elision; drag = elision without the crash-guard closure; checked = every safety mode ON and nothing elided; small = no crash guard. Proven: --mode=f1 assembly byte-identical to --bckelide (gate tooth), and the receipt carries one arm per mode. Peers: Cargo profiles are user-declared data, Zig ships Debug, ReleaseSafe, ReleaseFast and ReleaseSmall built into the compiler, Go has no optimisation levels (Part), Elm has --optimize. No exceed claimed: declared modes are table stakes; the exceed is the receipt that measures every mode side by side. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTRY-MISPOINTED` — PARTIAL: the organ is present but its registered path does not stat: re-register it at a path that exists. dossiernot adopted: the organ is present but its registered path does not stat: re-register it at a path that exists Pros Implementing source symbol found; runtime acceptance separate; ahead of GoCons not adopted yet: the organ is present but its registered path does not stat: re-register it at a path that exists	●	●	●	◐	●
Head-to-head receipt with one arm per compiler mode Measured: `h2_build_nx_mode` exists in `runtime/nx_lang_h2h.nx`, verified at emit. SHIPPED TO SOURCE 2026-09-01: nxmode_<name> rows in the bench conf become arms named nishilang-<name>, built through --mode=<name> so the receipt measures exactly the declared bundle and never a private copy of it. MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. The page renders the receipt (bench_pass) and nx_lang_h2h_gate proves it self-consistent. Peers publish compiler dashboards (rustc-perf, Go benchmarks) but no language publishes a cross-language receipt per mode on its own comparison page; scored 0 for all because none ships this artifact, and NO exceed is claimed until the receipt is produced by the PROMOTED toolchain on the estate host. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	○	○	○
Checked arithmetic at add-plus-jo cost (the daily mode as fast as the default) Measured: `x86ctx_ovf_fuse` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. LN18 SHIPPED TO SOURCE 2026-09-01 (x86ctx_ovf_fuse plus jo/jno in the sovereign assembler), gate nx_chkarith_jo_gate 15/15 GREEN on the candidate compiler: the checked loop carries jo/jno branches and adds ZERO xorq to the plain build (every checked add and sub site fused), MAX+1 still traps 72 where the plain build wraps to 91, MIN-1 still traps 72 where plain wraps to 159, __wrap_add stays exempt, and --mode=daily computes the same value -- with the bite proven (the trap fires on the overflowing add and stays silent on the in-range loop). MEASURED BEFORE on the receipt: the daily and checked modes cost 17,011 and 16,939 us against 7,145 us for the default build (2.4x) because LN1 lowers every checked add as backend-agnostic IR (xor, xor, and, compare-with-zero, branch) rendered as six instructions with stack spills per add. MEASURED AFTER, same receipt: daily 10,567 us and checked 10,688 us against 7,105 us default (1.49x). The fuse recognises the exact LN1 shape ((a xor r) and (b xor r)) less than zero with the four intermediates single-use by the emitter own G8 operand count and emits addq or subq then jo on the live flags; the predicate is identical, so it is equivalence-net work not a semantics change. THE DONE-RULE (within 1.3x of the default) IS NOT MET YET: the remaining 1.49x is register homing -- the allocator still sees the four skipped intermediates as uses and spills the accumulator around them, so the next step is to take the fuse decision before allocation. Peers: LLVM lowers llvm.sadd.with.overflow to add+jo for Rust debug builds and Zig ReleaseSafe; Go wraps silently by specification (no check to make cheap); Elm has no fixed-width integers. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads)	●	◉	◉	○	○
Integer SIMD reduction vectorization (packed adds for the accumulate loop) Source present; authored stronger claim: `opt_vec_reduce` in `runtime/nx_opt.nx`, verified at emit. LANDED 2026-09-28: opt_vec_reduce rewrites the counted accumulate loop into one OP_I64SUM lowered to four two-lane SSE2 accumulators; measured on the receipt host the f1 loop went 4164 to 981 us against gcc -O2 2075 us and clang -O2 1098 us, so the exceed is against gcc, rustc and go on this loop and within 0.9x of clang; the door compiler is 304d0f5d, the build lane promote_toolchain canary GREEN, nx_vecred_gate 43/43 on both hosts, the equivalence net 10 rows plus self-host plus KAT GREEN; the AVX2 four-lane door (LN19b) and the RV64 and wasm lowerings (LN19a) are the remaining width. THE GAP AS IT WAS MEASURED 2026-09-01: clang -O2 runs the same loop in 1,138 us on 14 AVX2 packed adds per iteration block and gcc -O2 in 2,082 us on a 6-instruction SSE paddq loop, while the f1-mode NishiLang loop is 7 scalar instructions (compare, jump, lea, load, add, increment, jump) with zero bounds-check work left to remove; the rest of the distance is vector width, not checks. Contract: a reduction-vectorization pass over the eqsat-normalised IR (LN8) for integer sums with a provable trip count, proven by the equivalence net. Research bar: the LLVM loop and SLP vectorizers [llvm-vectorizers]; the 2026 frontier attacks the conservative-analysis ceiling from the other side -- LLM-generated explicit SIMD that in some cases surpasses -O3 [arxiv-autoveccoder-2026], compiler-composed nanokernels competitive with hand-tuned microkernel libraries [arxiv-nanokernels-2025], and LLM-synthesised equality-saturation strategies that keep e-graphs tractable [arxiv-eggmind-2026] (listings mirrored as the dated index the survey was drawn from [arxiv-autovec-list-2026] [arxiv-eqsat-list-2026]). Peers: Rust and Zig inherit both LLVM vectorizers; Go does not auto-vectorize; Elm compiles to JS. Adoption: `LIB-WIRED importers=53 nonval=49` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◉	◉	○	○
Loop splitting for bounds the guard does not imply (IRCE) Measured: `bck_irce_split` exists in `runtime/nx_bck_elide.nx`, verified at emit. LANDED 2026-10-03 for the constant-bound case: a guard wider than the array is split into a main loop bounded by the array's length, whose check the induction pass then elides, and a post loop with the original guard and its checks (no pre loop: every admitted counter is proven non-negative). Measured on the wide-guard receipt kernel on one host in one hour: f1 18724 us before the rung and 8825 us after (2.12x), against clang -O2 6416, gcc -O2 7336, rustc with its checks 7291 and go 7865; gate nx_bck_iv_gate 42 of 42 on both hosts with the trap proven at exactly the first out-of-range index. NOT yet: the runtime bound while k < n (LN20a) and the pre loop (LN20b). ADMITTED 2026-09-01 as the next elision rung after LN7b. When the loop guard is WIDER than the array (the F2 fixture, `while k < 2048` over [1024]) the induction pass correctly keeps the check; LLVM instead splits the iteration space into pre-loop, main loop and post-loop so the main loop provably needs no range checks [llvm-irce]. Go prove covers a subset through its lattices without splitting [go-prove] (Part). Contract: emit the split under the same dominator-tree discipline and prove it with an F2-shaped fixture that must still trap exactly at the first out-of-range index. Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, Elm; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	●	◐	○
Energy per run on the receipt (RAPL package energy per arm) Source present; authored stronger claim: `h2_energy_arm` in `runtime/nx_lang_h2h.nx`, verified at emit. LANDED 2026-09-28 (lang LN23): h2_energy_arm reads the package energy counter (powercap RAPL) around the timed runs of every arm, or a discharging battery power_now times the summed elapsed_us, and writes energy rows (arm, uj_per_run, source, note) after the arm row through the one receipt writer; any host with neither counter writes -1 with source UNMEASURABLE by name, never a fabricated joule. The receipt of 2026-09-28 carries an energy row on all 9 arms; the WSL2 laptop that produces it exposes no powercap and its battery reads Not charging, so every row is UNMEASURABLE until a bare-metal or RAPL host runs the bench (the queued first VALID column). The reference method is the Energy-Languages study [energy-languages] (RAPL package counters around each run); no language ships this on its own comparison page, so the mechanism is a lead nobody holds (exceed 1) with its first measurement still owed. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, ElmCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	○	○	○
A lexer desync is attributed to the file and line that broke, never to the auto-appended crash handler Measured: `diag_desync_origin` exists in `runtime/nx_tokenizer.nx`, verified at emit. LN24. MEASURED 2026-09-02: a raw NUL inside a gate source produced twenty unknown-name errors at nx_crash.nx lines 36 to 99 (nx_compile_x86 expands the crash handler after every user file). THE CONTRACT: a control byte other than tab, LF, CR is refused by file and line, and an unterminated literal is reported at its opening line before any later file is expanded rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=73 nonval=69` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Compiler capacity limits are diagnostics naming the function, the cap and the count Measured: `diag_capacity_named` exists in `runtime/nx_ir.nx`, verified at emit. LN25. MEASURED 2026-09-02: nx_assert_lt idx=4096 cap=4096 tag=ir_block_new on a 253-name if-chain named the pool, not the function. THE CONTRACT: every cap reports the function, the cap, the measured count and the remedy rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=101 nonval=93` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Every diagnostic teaches in one voice: location, caret, why the build stopped, fix Measured: `diag_voice_gate` exists in `runtime/nx_diag_voice_gate.nx`, verified at emit. LN27. The parser's teaching sites already have the shape (nx_diag_caret plus why and fix lines); the LN24 desync messages first landed without it and the operator named the output as not helping a programmer grow. THE CONTRACT: a gate over every diagnostic emission site in the toolchain refuses a bare location; estate-wide, owned by the lang lane rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `GATE:LIVE trial=RED` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
A bare block statement is a scope Measured: `parse_stmt_block` exists in `runtime/nx_parse.nx`, verified at emit. LN32. MEASURED 2026-09-02: the parser had no production for `{ ... }` at statement start -- it fell into the expression fallback and its closing brace CLOSED THE FUNCTION EARLY, so three estate sources written with C-style inline blocks (a decimal printer used twice per function) had never compiled. Now a block is a scope: names declared inside die at its brace (block_base/n_locals, the for-body discipline); sibling blocks may reuse a name; a leaked name is refused by name. Fixture runs and returns the computed value (31); gate teeth in nx_dangling_else_gate. Every incumbent has block scope. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
A keyword at module level is named, not blamed on a brace Measured: `parse_module_stray_keyword` exists in `runtime/nx_parse.nx`, verified at emit. LN31. MEASURED 2026-09-02: a module-level `var g: i64 = 0` (module state is `static name: type`) and a stray top-level else both died on an assert that said ONE BRACE TOO MANY -- authors counted braces in a file whose braces balanced. Now the keyword names the cause (var: use static; let: use const or static; else/return/if/while: a function above closed early) with where, why and fix, and parsing continues so the end gate lists every problem. Teeth live in nx_dangling_else_gate (module-level var refused by name, static control compiles). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
An else with no if is refused, never run Measured: `parse_stmt_dangling_else` exists in `runtime/nx_parse.nx`, verified at emit. LN30. MEASURED 2026-09-02 on nx_autofix_intake_gate: an if/else chain closed one brace early left `} else { ... }` hanging as a SECOND else; the parser reached it through the expression fallback, produced nothing, and the block after it parsed as a bare block that RAN UNCONDITIONALLY -- every admission-refused row was counted twice while the gate printed a partition that did not sum. Now an else that begins a statement is refused by name with where (caret), why and fix; else-if chains and plain if/else untouched. Gate nx_dangling_else_gate (silent-class fixture: pre-LN30 compiled it with exit 0). Every incumbent refuses a stray else. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
A field name must belong to the struct it is read from Measured: `parse_field_of_struct` exists in `runtime/nx_parse.nx`, verified at emit. LN29. MEASURED 2026-09-02: f.name_bytes on a Function (which declares name_start and name_len) compiled and printed junk -- every .f site returned the base pointer unchanged when the field was not found. THE CONTRACT: a struct that declares fields and does not declare this one is refused in the teaching voice, naming the struct and the fields it really has; an unresolved stub (no fields known yet) keeps the silent path the self-build relies on. Rust, Zig, Go and Elm all refuse an unknown field by name rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption:* `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Line tables ride every API build so a fault address resolves on the deployed binary Measured: `hc_build_debug_armed` exists in `runtime/_hdl_build/nx_hostctl.nx`, verified at emit. LN26. MEASURED 2026-09-02: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and telling the reader to rebuild with -g; nx_addr2line refused the deployed binary (no .debug_line) and the source had moved. The whole chain existed (nx_cc -g, nxasm DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line, nx_dwline_e2e_gate) and no build path passed the flag. THE CONTRACT: hostctl buildrun passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, reversible without a rebuild). Go ships DWARF line tables in every build (Best); Rust release profiles default to debug=0 with line-tables-only as an opt-in (Part); Zig keeps them in Debug and ReleaseSafe and strips ReleaseFast (Part); Elm compiles to JS without source maps (No) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PRODUCER-ALIAS` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Elm; fully adopted on the estate ladderCons behind Go (leads)	●	◐	◐	◉	○
wasm threads from the sovereign backend -- shared memory, atomic loads stores and rmw, wait and notify (lang LN33) Measured: `wat_mem_shared` exists in `runtime/nx_wasm.nx`, verified at emit. MEASURED 2026-09-03: the served world pages carry COOP same-origin and COEP require-corp, so SharedArrayBuffer is unlocked for them, and the sovereign wasm emitter has no threads to spend it on -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify. Rival cells coded at INDEX LEVEL from the banked bars and UNPINNED for this row: Rust and Zig expose the wasm atomics target feature, Elm has none, Go runs goroutines on one wasm thread rather than the threads proposal. Contract: the 0xFE-prefixed opcode family and a shared memory with a declared maximum from nx_wasm and nx_wasm_scalararm, lowered by nx_compile_wat, surfaced as an atomic intrinsic family beside the LN6 send marker; proven in a sovereign VM twin and in a browser over the CDP wire with two Workers on one counter. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	◐
The same atomic names lower to hardware on the native lanes -- LOCK-prefixed x86-64, rv64 AMO, futex wait and notify (lang LN34) Measured: `rv_home_t6` exists in `runtime/nx_riscv.nx`, verified at emit. OPERATOR 2026-09-03: one source, three lowerings -- the IR atomic family (__atomic_* builtins, nx_atom.nx) lowers to 0xFE on wasm (LN33), LOCK on x86-64 (pre-existing) and lr/sc + AMO on rv64 (LN34, source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim, toolchain canary owed). Rust, Zig and Go lower atomics to the ISA natively; Elm has no threads. Contract: LOCK xadd, cmpxchg, xchg, mfence on x86-64, amoadd, amoswap, lr and sc on rv64, futex on Linux and the NishiOS wait queue, behind the same names, with the two-worker lost-update neg-control proving it. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=12 nonval=11` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	●
memory64 -- the wasm32 4 GiB wall as a declared choice, never a ceiling (lang LN35) Source present; authored stronger claim: `wasm_memory64` in `runtime/nx_wasm.nx`, verified at emit. LANDED 2026-09-27 on the sovereign VM twin: wasm_memory64 (nx_wasm.nx) decides the index type ONCE from `nx_compile_wat --memory64` or a module static nx_wasm_memory64_req = 1; every address stays i64 (the one narrowing site emits nothing), the memory is (memory i64 N), data offsets are i64.const, the mmap helper grows in i64 and fails with -1; nx_wat_compiler encodes limits flag 0x04 (4/5/7) and i64.const data offsets; nx_wasm_vm reads the flag, u64 limits, a 2^48-page ceiling and i64 grow; shared+memory64 is refused by name. Proof: nx_wasm_run_gate 28/28 (the door probe runs to checksum 686096800 under both index types, the wasm32 twin keeps its wraps) and the wasm64 door row in lang_doors.conf. UNMEASURED and queued: a module past 65536 pages instantiating in a memory64 browser over the CDP wire (the oracle stays outside), a declared MAX on unshared memories. Rust and Zig target wasm64 behind flags (Yes); Go and Elm do not (No); Nishi exceeds by making it a door on one source, decided once. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	●	○	◐
One source builds at a sensor's memory and at a supercomputer's: the wasm memory is a build-lane door, not a constant in the source Measured: `watd_atoi` exists in `runtime/nx_compile_wat.nx`, verified at emit. LN36. LN33 let a module declare its memory with statics, which is right for a wasm-only module and IMPOSSIBLE for a dual-target one -- nx_wasm_craft compiles natively too and the native lane refuses a non-zero static initializer by name. --shared <req> <max> moves the declaration to the build lane where the standing order says a target's limit belongs; --nothreads emits the unshared twin at the same size, so one source ships both artifacts. Byte-identical WAT when the flag is absent; both malformed forms refused by name; nx_wasm_threads_gate 37/37 on the NAS rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_wasm_threads_gate` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Decimal literal machine: exponent form, 18 significant digits, sticky rounding Measured: `LEX_DEC_SIG_DIGITS` exists in `runtime/nx_tokenizer.nx`, verified at emit. LANDED 2026-09-03 rung LN36 and LN40. One digit machine feeds the integer and float tokens as (m, e10, sticky); 1e9, 2.5E-3 and 6.02e+23 lex, a 20-digit fraction costs a sticky bit instead of looping the compiler forever, and an integer literal needing a 65th bit is REFUSED by name rather than wrapped. Bound is u64 max because the estate writes unsigned bit patterns in decimal. Proven by nx_f64_gate 33 of 33 on the NAS. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=73 nonval=69` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Correctly rounded decimal-to-binary64 packing at any magnitude Measured: `fp64_from_dec` exists in `runtime/nx_quant.nx`, verified at emit. LANDED 2026-09-03 rung LN36 and LN40. Exact rational core when the significand fits 2^53 and the power of ten fits an i64; a 128-bit wide path otherwise (umulhi chunks of 5^25, one rounding at the end). Correctly rounded through 1e-43 and within 1 ulp beyond, exact wherever no bits are dropped. Peers: strtod-class conversion. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	●	●	●	●
Floating-point constant expressions Measured: `const_eval_f64_addsub` exists in `runtime/nx_parse.nx`, verified at emit. LANDED 2026-09-03 rung LN39. const NAME: f64 = EXPR folds with the same software IEEE-754 routines the f64 gate proves bit-for-bit against the hardware ops, so a folded constant equals what the program computes at run time. Before this only integer literals were accepted and every f64 constant had to be written as a zero-argument function. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Whole-population compiler census (every program, reason-classified, hang-aware) Source present; authored stronger claim: `lc_base_class` in `runtime/nx_langcensus.nx`, verified at emit. LANDED 2026-09-03. The incumbent compiler ruler nx_cc_equiv_gate runs 10 corpus rows; a sample can prove a mechanism and never a population. This organ compiles all 13790 top-level programs with a given compiler, classifies OK ERR HANG HARNESS with the reason attached, and against a baseline census NAMES every program whose class moved. It caught a 286-program regression that every fixture and the 10-row gate called GREEN. EXCEED: no peer toolchain ships a whole-corpus reason-classified refusal census as a first-class organ. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, ElmCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	●	●	●	●
RETRACTED-SEE-NOTE Bounds-check elision cost model DARK — `runtime/nx_bck_elide.nx` EXISTS but does not declare `bck_elide_cost_model`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 BY nx_bck_elide_gate AGAINST THE LIVE PROMOTED COMPILER, THREE SEQUENTIAL ROUNDS, SAME DIRECTION EVERY TIME. Elision is a large win on the div-free checked accumulate loop (h2h_A2_divfree no_elision 41266 / 41414 / 63498 us against with_elision 20711 / 21284 / 24547 us = 1.95x to 2.59x) and a consistent LOSS on the modulo-bearing arm (h2h_A_modulo no_elision 102547 / 112873 / 130564 us against with_elision 112529 / 116453 / 139372 us = plus 9.7, 3.2 and 6.7 percent). The pass therefore has NO COST MODEL: it elides wherever the dominance oracle blesses the site, including shapes where removing the check perturbs block layout or scheduling around a long-latency divide and costs more than the check it removed. The gate PUBLISHES both ratios and GATES NEITHER, so the win and the regression are equally invisible to every consumer -- nothing in the estate would have caught this. WATCHING bck_elide_cost_model: the pass must consult a cost model and DECLINE the elision where it does not pay, and the gate must GATE the modulo arm rather than merely printing it. SOUNDNESS IS UNAFFECTED IN EITHER DIRECTION -- a declined elision is always safe -- so this is a pure performance rung carrying no memory-safety exposure, which is also why it can be worked without re-blessing the dominance oracle. RETRACTED 2026-09-03 BY ITS OWN AUTHOR, SAME DAY: THE MODULO REGRESSION WAS MEASUREMENT NOISE ON A SATURATED BOX AND THIS RUNG'S PREMISE IS WRONG. The three rounds above were taken on the NAS while its write path was degraded, where run-to-run spread on that arm was 102547 to 130564 us -- 27 percent -- so a consistent 3 to 10 percent direction across three samples sat well inside the noise band and should never have been published as a finding. RE-MEASURED ON A QUIET HOST, 15 INTERLEAVED ROUNDS, minimal fixtures compiled by the same compiler with and without --bckelide: div-free median 8275 us plain against 5210 us elided = 1.59x WIN, and modulo median 45807 us plain against 44851 us elided = 1.02x with the min-max ranges OVERLAPPING (plain min 45302, elided max 45810). Elision is a LARGE WIN where the loop is check-dominated and NEUTRAL, not harmful, where a 20-to-40-cycle idiv dominates the body -- the physically sensible result, since the check costs a small fixed amount and a divide swamps it. THERE IS THEREFORE NO COST MODEL TO BUILD AND NO SHAPE THAT MUST BE DECLINED. THE REAL FINDING THIS EXPERIMENT UNCOVERED IS LARGER: the estate compiles EVERY organ in DEFAULT mode -- no build lane passes --mode at all -- so it builds itself in the slowest mode the language offers, while f1 (exactly --bckelide) is proven sound by nx_bck_elide_gate 13/13 and measures 1.59x here and 7105 against 4189 us on the published h2h receipt. That is a BUILD-LANE POLICY question and deliberately NOT a compiler-default change: the default-OFF contract is load-bearing (nx_compile_x86 states it -- default builds stay byte-identical by construction, which is what every drift and contentdiff instrument rests on), and flipping it estate-wide would re-baseline all of those instruments at the same moment, so the undo path would traverse the very comparison surface needed to judge the change. Superseded by the build-mode rung; this row stays open only as the record of a retracted claim. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching bck_elide_cost_model Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads); open contract; expected source declaration not established	○	◉	◉	◉	○
The estate builds itself in its FASTEST proven-sound mode, not its slowest DARK — `runtime/nx_ccbuild_lib.nx` EXISTS but does not declare `cb_mode_policy`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 AND IT IS THE LARGEST UNCLAIMED PERFORMANCE WIN ON THIS BOARD. No build lane in the estate passes --mode at all: a grep for mode=f1 across the build-lane sources returns one hit and it is a GATE, not a builder. So every organ ships compiled in DEFAULT mode, which by deliberate contract has every declared mode OFF -- including --bckelide, LN7 sound bounds-check elision, which is already written, already promoted, and already proven by nx_bck_elide_gate 13/13 against the LIVE compiler with both out-of-bounds legs still trapping 71. THE COST OF THAT, MEASURED TWO INDEPENDENT WAYS: the published h2h receipt reads nishilang-default 7105 us against nishilang-f1 4189 us on the same workload (1.70x), and a 15-round interleaved re-measure on a quiet host with minimal fixtures reads 8275 us plain against 5210 us elided (1.59x). On a divide-dominated loop the same comparison is 45807 against 44851, i.e. NEUTRAL -- so the mode is a win where it can be and costs nothing where it cannot. FOR SCALE: at 4189 us NishiLang-f1 BEATS rustc -O with bounds checks live (4445 us) and ties Go (4163 us) on the identical bounds-checked workload, while the default build we actually ship trails both by 1.7x. WATCHING cb_mode_policy: the build lane declares the mode it compiles organs with, as DATA, so the estate stops shipping its slowest mode by omission. DELIBERATELY NOT A COMPILER-DEFAULT CHANGE, and this is the load-bearing part: nx_compile_x86 states the default-OFF contract in its own source -- default builds stay byte-identical by construction, which is exactly what every drift, contentdiff and artifact-comparison instrument in the estate rests on. Flipping the language default would re-baseline ALL of those instruments in the same instant, so the undo path would run straight through the comparison surface needed to judge whether the change was safe -- the static-stability violation this estate already has doctrine about. The transition therefore belongs in the BUILD LANE, staged and per-target, with nx_behaveprobe proving output identity on each organ before its mode moves. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cb_mode_policy Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads); open contract; expected source declaration not established	○	◉	◉	◉	○
Whole-corpus compile census -- every program in the tree compiled, partition reconciles Measured: `lc_class_name` exists in `runtime/nx_langcensus.nx`, verified at emit. The field's equivalent is a whole-ecosystem rebuild: Rust runs crater over crates.io and Go rebuilds the module corpus before a release. Ours compiles every top-level program in the tree and partitions ok/err/hang so the sum reconciles. MEASURED 2026-09-04: 13,784 programs, and the refusal count is only meaningful with a scope -- a laptop census is NOT an estate figure. Joining it against the estate's own sha256 manifest gives 135 closure-proven estate refusals, 119 unproven, 30 excluded, summing to 284. PARITY of method; the honesty of the scope label is the distance. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons behind Rust (leads), Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	●	◉	●
Closure-identity scope on any cross-tree claim -- a leaf-identity proof cannot carry a closure-level claim DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_closure_scope`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_closure_scope. No mainstream toolchain publishes a compile-refusal figure scoped by TRANSITIVE CLOSURE identity, because they build one tree; ours has two, and MEASURED 2026-09-04 that distinction moved a published claim from 284 to 139 -- a file byte-identical to the estate still failed here because a module it IMPORTS was stale. Done when the census resolves imports the way the builder does and stamps every row PROVEN or UNPROVEN by closure hash rather than by leaf hash. The exceed is structural: the rivals have no second tree, so the field has never needed this and does not have it. dossierwatching lc_closure_scope Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Compiler self-validation -- equivalence net plus self-host before any toolchain promote Measured: `eq_files_equal` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Multi-stage bootstrap comparison is the field's standard for trusting a compiler with itself; equivalence-modulo-inputs fuzzing is the research standard for finding the miscompiles a bootstrap cannot [emi2014]. Ours gates every toolchain promote on an equivalence net plus self-host and auto-rolls-back on a failed canary. Rust, Zig and Go all bootstrap (Best); Elm is written in Haskell and does not (No). Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons behind Rust (leads), Zig (leads), Go (leads); not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	◉	◉	◉	○
Mutation testing over the gate fleet -- a green that never had a red is unverified Measured: `gb_art_same_as_base` exists in `runtime/_hdl_build/nx_gate_bite.nx`, verified at emit. Mutation testing is a research-grade practice the compiler field rarely runs in CI; Rust has cargo-mutants as a community tool, the others none in-tree. Ours drives mutants through the SUBJECT as well as the test and reports NOT-SUBSTITUTABLE by artifact identity when a mutation cannot reach the binary, which is the failure mode that makes naive mutation testing report a vacuous pass. NOT coded as an exceed: running it is not the same as running it over the whole fleet, and the fleet sweep is bounded, so the honest reading is a stronger tool at unproven coverage. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	○	○	○
Benchmark receipts with a declared control and a repro command Measured: `h2_refuse` exists in `runtime/nx_lang_h2h.nx`, verified at emit. Statistically sound measurement demands a control for layout and environment bias, not a single timed run [stabilizer2013]; Rust publishes perf.rust-lang.org and Go ships benchstat. Ours emits a RECEIPT carrying host, toolchain version, source and binary sha256, min and median, a checksum every arm must print, and the repro command, and REFUSES to grade when an arm's checksum differs. Measured on the promoted toolchain: 3.33x gcc -O2 and 1.6x Rust-checked -- not a peer on speed, and the page says so with the receipt attached. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons behind Rust (leads), Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	●	◉	○
Diagnostics graded against the field's benchmark for human-readable errors Open — watching `runtime/nx_cc_sovereign.nx` : `cc_diag_grade`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Elm set the field's bar for compiler errors addressed to a person rather than a parser [elm-errors] and Rust adopted it. MEASURED 2026-09-04 on real refusals, the shipping compiler already emits the three-part shape -- a caret line, a why the build stopped clause, and a fix clause -- and names the enclosing construct: two definitions of X, the earlier one is at line N; this block is opened here and never closed. WATCH cc_diag_grade because none of that is MEASURED: done when a fixture set of known-bad programs is graded for span accuracy and suggestion correctness and the score is published here rather than asserted. dossierwatching cc_diag_grade Pros none measured yetCons behind Rust (leads), Zig, Go, Elm (leads); open contract; expected source declaration not established	○	◉	●	●	◉
Declared expect-fail fixtures -- a program whose purpose is to refuse must say so DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_expect_fail`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Every mainstream toolchain declares its negative tests IN the fixture: rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck. The estate has NO equivalent, and MEASURED 2026-09-04 that gap is live -- 7 of 135 proven refusals are deliberate negative controls, one of which states that if it ever builds the resolver has gone fail-open and its fix is refuted. FIXING THOSE ROWS WOULD DESTROY THE CONTROLS. The 7 was found by the fixtures' own vocabulary and is a FLOOR, not a total: sibling fixtures carrying no marker phrase are invisible to it. Done when a declaration field exists and the census partitions expect-fail from defect mechanically, the same conclusion organ_kind.conf and organ_gate.conf each reached from their own side. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching lc_expect_fail Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads), Elm; open contract; expected source declaration not established	○	◉	◉	◉	●
Dead-code and unwired-symbol census across the whole tree Measured: `uw_exported` exists in `runtime/_hdl_build/nx_unwired.nx`, verified at emit. Go makes an unused variable a compile error and Rust ships dead_code as a default-on lint; Elm's compiler reports unused values. Ours is a whole-tree census with a NAME-SET ratchet rather than a count, so a rise names the function and the file -- a count-only ratchet on a shared tree reports a regression without saying whose. PARITY of intent, and the name-set form is the part worth keeping. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separateCons behind Rust (leads), Go (leads), Elm (leads); not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	◉	●	◉	◉
Diagnostic object model rendered by three emitters DARK — `runtime/nx_parse.nx` EXISTS but does not declare `nx_diag_object`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH nx_diag_object. The 2026 bar is a diagnostic OBJECT (message tree, spans, fixes, optional graph) with several emitters from the one object: GCC 16 nests its errors, emits SARIF 2.2-track and experimental HTML and dropped its legacy JSON [gcc16], and rustc made one renderer library the only stable human emitter [rustc-annotate]. Done when nx_diag_caret is fed from one object that a nested terminal renderer, a kv or JSON sink and a line-oriented socket stream all consume; SARIF, HTML and graphs are deferred behind the object. dossierwatching nx_diag_object Pros none measured yetCons behind Rust, Zig (leads), Go, Elm (leads); open contract; expected source declaration not established	○	◐	◉	●	◉
Renderer snapshot corpus over the refusal census DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_diag_snapshot`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_diag_snapshot. rustc switched renderers only after matching the old output over its test corpus [rustc-annotate]. Done when the 13,721-program census (count printed) carries a stored rendering per refusal so a renderer swap is adjudicated by byte-diff count, and the negative control holds: a renderer that drops a nested child must show at least one differing snapshot. dossierwatching lc_diag_snapshot Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract; expected source declaration not established	○	◐	●	●	●
Machine-readable diagnostics validate against a pinned schema Open — watching `runtime/nx_cc_sovereign.nx` : `cc_diag_schema`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH cc_diag_schema. GCC validates every generated SARIF file against the schema in its testsuite and SKIPS when the validator is absent [gcc-sarif-schema]; SARIF 2.1.0 is the only published standard and 2.2 is an undated draft tree [sarif-tc]. Done when the 2.1.0 schema is mirrored and pinned, every machine-readable diagnostic the compiler emits validates against it, and a missing validator announces SKIP rather than passing. The 2.2 schema is a watch, not a target. dossierwatching cc_diag_schema Pros none measured yetCons behind Rust; open contract; expected source declaration not established	○	◐	○	○	○
Optimisation-directed fuzzing with a per-pass refinement oracle DARK — `runtime/nx_shapeprobe.nx` EXISTS but does not declare `sp_pass_directed`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH sp_pass_directed. Fuzzing directed by which optimisation pass changed, judged by a refinement oracle per pass rather than end-to-end output, found 55 new LLVM miscompilations [optimuzz]. The estate's differential EMI oracle (eq_build) is the end-to-end form; the per-pass oracle needs SMT-class semantics for the IR that do not exist yet, so this is LARGE and ranked behind the certificate unit below. No rival column ships it either. watching sp_pass_directed Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Mutators mined from the compiler own bug history DARK — `runtime/nx_shapeprobe.nx` EXISTS but does not declare `sp_mutator_from_bug`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH sp_mutator_from_bug. 587 mutators mined from 1,760 GCC and LLVM bug reports found 65 new bugs [issuemut]. Done when an extractor over the estate's own compiler-defect rows emits source-level rewrite rules and replays them through the fuzz lane; the prerequisite is that defect rows carry their triggering input, which the debt board does not yet require. dossierwatching sp_mutator_from_bug Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Lowering-rule verification kept fresh against the model Measured: `eq_build` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Cranelift committed to continuous formal verification of its lowering rules in CI after a stale-rule defect class [wasmtime-adv]. The estate's equivalence net and nx_gatefresh already re-prove lowering against the model on every build, so this row measures a bar the estate meets rather than a gap; not claimed as an exceed because the two are equal. Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	●	●	○	○
Certified compilation as the oracle; per-pass certificates as the unit DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_pass_certificate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_pass_certificate. CompCert 3.18 [compcert318] and Brack via CakeML [brack] are the certified-compilation oracles; the estate hosts no proof assistant and the field measures full verification at about ten times the cost of credible compilation [rinard10x]. Done when unreachable-code, dead-assignment and constant-fold each emit a certificate that a checker sharing no code with the pass accepts over the whole census (count printed) while the byte-identical self-host rebuild is preserved; a mutant pass that folds one constant wrongly must be refused naming the pass and site. dossierwatching opt_pass_certificate Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Missed-peephole two-axis harness DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_peephole_bench`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_peephole_bench. Agents cannot yet match humans on missed peepholes, and the benchmark scores soundness and profitability as two axes [peepholebench]. Done when each candidate rewrite is scored sound by the existing equivalence probe and profitable by instruction count, both printed, and an unsound-but-profitable rewrite is reported REJECTED rather than one of two. dossierwatching opt_peephole_bench Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Whole-ecosystem rebuild census with a named-reason spurious partition DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_rebuild_partition`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_rebuild_partition. Crater runs over 1,026,208 crates with a thirteen-way taxonomy that names spurious results by reason and re-runs only changed rows [crater159343]; the Fedora 45 mass rebuild is the distribution-scale routine [fedora45]. Done when, after a toolchain change, every downstream source is rebuilt and the receipt partitions regressed, fixed, spurious-regressed, spurious-fixed and unchanged with the spurious reason named (OOM, timeout, admission refused, diagnostic change), the partition summing to the population, and an admission refusal lands in spurious with its reason rather than in regressed. dossierwatching lc_rebuild_partition Pros none measured yetCons behind Rust, Go; open contract; expected source declaration not established	○	◐	○	●	○
Known-bug rows require an issue id and go RED on unexpected pass DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_known_bug_id`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_known_bug_id. rustc requires an issue number on every known-bug directive and its crashes suite goes red when a crash stops reproducing [rustc-directives]; lit and DejaGnu carry the same expect-fail and unsupported vocabulary [llvm231]. Extends LN48: done when a known-bug row without a debt or issue id is refused at parse, the row is GREEN only while the bad behaviour still fires, and an unexpected pass goes RED as a class distinct from ignore, with rows per class printed so zero of zero cannot read green. dossierwatching lc_known_bug_id Pros none measured yetCons behind Rust, Zig (leads), Go (leads); open contract; expected source declaration not established	○	◐	◉	◉	○
Backtracking register allocator fuzzed with generated functions DARK — `runtime/nx_x86_64_ctx.nx` EXISTS but does not declare `x86_regalloc_backtrack`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH x86_regalloc_backtrack. The successor to Cranelift's allocator is a backtracking allocator developed with generated-function fuzzing [regalloc3]. The estate's allocator watch (x86_use_regalloc) is the prerequisite; done when the allocator backtracks on spill pressure and a generated-function fuzz lane compares its output to the naive allocator by behaviour over a printed count of functions. dossierwatching x86_regalloc_backtrack Pros none measured yetCons behind Rust, Zig, Go (leads); open contract; expected source declaration not established	○	◐	●	◉	○
Masked and uncounted-loop vectorisation DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_vec_masked`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_vec_masked. GCC 16.1 vectorises uncounted loops and peels for VLA alignment with masked epilogues [gcc16]. LARGE and ranked in the third tier behind the integer reduction rung LN19; done when a loop whose trip count is unknown at entry is vectorised with a masked tail and the receipt prints the vectorised loop count against the census. watching opt_vec_masked Pros none measured yetCons behind Rust, Zig, Go; open contract; expected source declaration not established	○	◐	●	●	○
Bounded acyclic e-graph with a stochastic-search control DARK — `runtime/nx_eqsat.nx` EXISTS but does not declare `eqsat_bounded_acyclic`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH eqsat_bounded_acyclic. The 2026 workshop state pairs bounded acyclic e-graphs, the form Cranelift ships, with stochastic-search controls [egraphs2026]. The estate's engine (nx_eqsat_union) is the unbounded form; done when saturation is bounded acyclically with the bound as a conf row and a stochastic control run shows the bounded form finds the same rewrites on the census subset, counts printed. dossierwatching eqsat_bounded_acyclic Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Full-source bootstrap chain with an SBOM of the seed DARK — `runtime/_hdl_build/nx_bless_compiler.nx` EXISTS but does not declare `bc_seed_sbom`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH bc_seed_sbom. Guix 1.5.0 bootstraps from a hand-auditable seed and ships SBOMs for it [guix150], while rustc still starts from a downloaded prebuilt checked by repro-check [rust-stage0]. The estate self-hosts with stage2 equal to stage3 (eq_files_equal); done when the chain below the first sovereign stage is enumerated as data with hashes and a seed SBOM the bless organ refuses to install without. Third tier: LARGE. watching bc_seed_sbom Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Reproducibility as a migration gate (bar; deploy DL14 owns the unit) Measured: `eq_files_equal` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Debian blocks unreproducible packages from migrating to testing since May 2026 [debian-repro-gate26]. The estate's self-host rebuild is already byte-identical (eq_files_equal); the promote-time build-twice refusal is deploy rung DL14, cross-cited so this board does not carry a second ruler. Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	○	○	○	○
Superiority scorecard: every axis measured against every rival Measured: `ls_scorecard` exists in `runtime/nx_lang_scorecard.nx`, verified at emit. WATCH LN67. Superior is a number per axis per rival (speed on the h2h checksum, compile time, binary size, energy, the CWE classes the bug dumps blame, graded diagnostics, the tooling ring) reading WIN LOSE TIE or UNMEASURED, against the rival version named this month: Rust stable 1.98.1 [rust-releases-2026-09], GCC 16.2 [gcc16-changes-2026-09], Go 1.27.1 [go-release-history-2026-09], Zig 0.16.0 [zig-download-2026-09]; every rival publishes its own benchmarks and release notes, none publishes a head-to-head scorecard against its peers, so the cells code what they publish Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads), Go (leads)	●	◉	◉	◉	●
Rival release bars as data on a beat DARK — `runtime/nx_lang_scorecard.nx` EXISTS but does not declare `ls_rival_bars`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH LN68. The four release pages fetched monthly, versions parsed into a pinned bar row so a WIN or LOSE always names the rival version it was measured against; the September 2026 cs.PL listing is the research bar beside them [arxiv-cspl-2026-09-22] dossierwatching ls_rival_bars Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract; expected source declaration not established	○	●	●	●	●
Serial elision verified by the compiler Open — watching `runtime/nx_serial_elision_lib.nx` : `se_elide`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN70. Every parallel construct carries a sequential meaning and the compiler verifies the two agree on the determinism checksum; no rival column verifies sequential-parallel equivalence in its compiler (Rust, Zig and Go leave the two programs to the author; Elm has no parallel form), so this is an exceed once it lands, and it reads 0 for every rival by the same read [arxiv-fluid-2026-09] [opencilk-site] dossierwatching se_elide Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Schedule as data beside the algorithm Open — watching `runtime/nx_schedule_lib.nx` : `sc_schedule_apply`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN71. Tile, vectorize, parallel, unroll and compute-at as a conf per hot loop, applied by the compiler and never written into the source; none of the four rival columns carries a schedule language apart from the code [halide-site] dossierwatching sc_schedule_apply Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Effect handlers as the scheduling seam Open — watching `runtime/nx_effect_lib.nx` : `eh_handle`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN72. One-shot delimited continuations and handlers so sequential, async and parallel schedulers are written over one direct-style program; OCaml 5 is the bar and none of the four rival columns has effect handlers in the language [ocaml53-effects] dossierwatching eh_handle Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Mapping orthogonal to correctness Open — watching `runtime/nx_mapper_lib.nx` : `mp_map`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN73. Where tasks run and where data lives is a mapper decision from the container envelope, guaranteed to change timing and never a result; no rival column separates mapping from the program [legion-overview] dossierwatching mp_map Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Energy on the receipt Open — watching `runtime/nx_energy_receipt_lib.nx` : `en_joules`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN74. Package joules per arm in lang.bench where the host exposes RAPL and UNMEASURED elsewhere; no rival toolchain reports energy in its own receipt either, so the cells read 0 and the exceed is the receipt itself [energy-languages] dossierwatching en_joules Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Doors as lowering dialects Open — watching `runtime/nx_door_lower_lib.nx` : `dr_lower_door`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN75. Each target a declared lowering table, an absent door a named refusal; Rust, Zig and Go reach many targets through LLVM or their own backends today and read 1, Elm emits JavaScript only [mlir-site] dossierwatching dr_lower_door Pros none measured yetCons behind Rust, Zig, Go; open contract; expected source declaration not established	○	●	●	●	○
Compile-time execution of the language itself Open — watching `runtime/nx_comptime_lib.nx` : `ce_comptime_eval`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN76. Ordinary NishiLang run at compile time on the integer lane, refusing nondeterministic inputs by name; Rust reads 1 (const evaluation and procedural macros), Zig 1 (comptime), Go 0, Elm 0 [zig-overview] dossierwatching ce_comptime_eval Pros none measured yetCons behind Rust, Zig; open contract; expected source declaration not established	○	●	●	○	○
Syntax extension elaborated in the language Open — watching `runtime/nx_syntax_ext_lib.nx` : `sx_extend`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN77. A declared notation elaborates to core code through comptime; Rust reads 1 (macro_rules and procedural macros), Zig 0 (no macros by design), Go 0, Elm 0 [racket-site] [arxiv-onelang-2026-09] dossierwatching sx_extend Pros none measured yetCons behind Rust; open contract; expected source declaration not established	○	●	○	○	○
The mathematician's stack in the language Open — watching `runtime/nx_mathstack_lib.nx` : `mx_exact`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN78. Exact rationals, bigints, bigfloat, symbolic differentiation and linear algebra reachable as language under LN77 notation with Lean, Julia and Mathematica as outside oracles; no rival column carries this in the language, all four reach it through libraries or another program [julia-why] dossierwatching mx_exact Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Proofs checked in the language Open — watching `runtime/nx_proof_lib.nx` : `pv_check`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN79. Propositions as types with a checked kernel; Lean is the bar and none of the four rival columns states or checks a proof in the language [arxiv-onelang-2026-09] [lean-site] dossierwatching pv_check Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Zero add-on ratchet Source present; authored stronger claim: `la_addon_census` in `runtime/nx_lang_addons_lib.nx`, verified at emit. WATCH LN80. Every foreign program a workflow forks, counted by name and by the language gap it stands in for, and the number may only fall; no rival toolchain counts its own add-ons, so the cells read 0 and the exceed is the ratchet itself Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Whole-system receipts beside the loop receipt Open — watching `runtime/nx_whole_receipt_lib.nx` : `ws_whole_receipt`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN81. Every lang rung carries the engine's number (nofloat decode, emitter page time, browser frame) beside its loop receipt on one checksum per engine; no rival toolchain accepts a compiler change on a whole-system receipt of its own products, so the cells read 0 and the exceed is the receipt dossierwatching ws_whole_receipt Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Domain known-answer suites with the field's tools as outside oracles Source present; authored stronger claim: `dk_run_suite` in `runtime/nx_domain_kat_lib.nx`, verified at emit. WATCHING dk_run_suite (lang LN82, admitted 2026-09-26): a .kat row set per domain, the runner drives the estate organ per row and prints pass, fail and unreachable that sum; the first suite is Charlwood's 50 integrals with the SymPy paper's verified answers as the outside oracle [sympy-charlwood-2609-25616]. No rival ships a domain KAT ruler in its toolchain: the row is ours to fill and nobody else's to lose Adoption: `LIB-GATE-ONLY importers=2` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, ElmCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	◉	○	○	○	○
The mathematician's notation: exact, symbolic and unit arithmetic as syntax Open — watching `runtime/nx_mathstack_lib.nx` : `mx_notation`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING mx_notation (lang LN83): exact integers and rationals, symbolic integration and series and SI units reachable as notation elaborated in the language; the bar is Lean's in-language extension and FloatLib's certified execution [floatlib-2609-19352]. Rust, Zig, Go and Elm carry none of it in the language dossierwatching mx_notation Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The economist's stack: tables, least squares and panel models in the language Open — watching `runtime/nx_econ_lib.nx` : `ec_ols`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING ec_ols (lang LN84): tables, OLS, fixed-effects panel and a time-series spine as language values, graded against R's lm on a published dataset with R run outside as the oracle [r-sources-2026-09] dossierwatching ec_ols Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The writer's stack: sentences, tags and parses as language values Open — watching `runtime/nx_text_lib.nx` : `tx_parse`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING tx_parse (lang LN85): the aspect lane's tagger, parser and CRF reachable as language values with a pattern notation, graded against the field's tagger on a mirrored Universal Dependencies sample dossierwatching tx_parse Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The chemist's stack: molecules, SMILES and units in the language Open — watching `runtime/nx_chem_lib.nx` : `ch_mol`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING ch_mol (lang LN86): molecule graph, SMILES parse and emit and typed quantities, graded against RDKit run outside on a mirrored SMILES set dossierwatching ch_mol Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The Kaggle door: a static ELF entry that reads the competition data and writes a scored submission Open — watching `runtime/nx_kaggle_door.nx` : `kg_submit`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING kg_submit (lang LN87): the notebook image is Python 3.12 with gcc and no Rust, Julia or wasm runtime [kaggle-docker-python-2026-09], so a sovereign entry is a static ELF the notebook executes and the receipt carries the public leaderboard score beside the Python baseline; Rust, Zig and Go reach the notebook only through an in-notebook toolchain install (Part), Elm not at all dossierwatching kg_submit Pros none measured yetCons behind Rust, Zig, Go; open contract; expected source declaration not established	○	◐	◐	◐	○
The TRACTOR arena: C to NishiLang translation graded by the DARPA benchmark's own tests Open — watching `runtime/nx_c2nx.nx` : `tr_translate`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING tr_translate (lang LN88): DARPA's TRACTOR benchmark grades C-to-Rust translators with its own tests [tractor-bench-2609-25121]; Rust is the benchmark's target (Part: the translators are third-party tools, not the toolchain); the exceed candidate is translation into a language whose safety ring is declared modes rather than an unsafe escape hatch dossierwatching tr_translate Pros none measured yetCons behind Rust; open contract; expected source declaration not established	○	◐	○	○	○
CRA conformance receipt: SBOM, vulnerability handling and reporting evidence on every shipped artifact Open — watching `runtime/nx_cra_lib.nx` : `cra_receipt`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING cra_receipt (lang LN89): the EU Cyber Resilience Act reporting obligation applies from 11 September 2026 [eu-cra-2026-09]; Rust (cargo-sbom, cargo-auditable) and Go (go version -m, govulncheck) carry Part of it as tooling; the receipt here rides on the content-addressed package lane and the written spec dossierwatching cra_receipt Pros none measured yetCons behind Rust, Go; open contract; expected source declaration not established	○	◐	○	◐	○
Per-category standing on the scorecard Measured: `ls_category_lines` exists in `runtime/nx_lang_scorecard.nx`, verified at emit. WATCHING ls_category_lines (lang LN90): every verdict counted under its @cat line, cat rows beside the score rows, the category count derived from the board Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
The sensor door: a microcontroller-class lowering from the same source under the never-brick classifier Open — watching `runtime/nx_door_lower_lib.nx` : `dr_door_mcu`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING dr_door_mcu (lang LN91): an RV32 or Cortex-M lowering declared as a door, the door-census fixture on the simulator with the x86-64 checksum, every persistent write classified by nx_mcu_brick; Rust (no_std) and Zig (freestanding) reach microcontrollers today, Go through TinyGo (Part), Elm not at all; LispBM's users are the bar for what a sensor program grows into [lispbm-2609-23009] dossierwatching dr_door_mcu Pros none measured yetCons behind Rust, Zig, Go; open contract; expected source declaration not established	○	●	●	◐	○
The quantum door: a hybrid quantum-classical dialect with a sovereign statevector simulator as its first target Open — watching `runtime/nx_door_lower_lib.nx` : `dr_door_quantum`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING dr_door_quantum (lang LN92): a dialect declared as data lowering QFT and Grover fixtures to an integer-deterministic statevector simulator matched against the field's simulator run outside; the frontier this month is dynamic hybrid programs with gates as first-class IR values [quantum-dynamic-ir-2609-01037] [quantum-backline-2609-09270] [granthi-2608-20443]; no rival column carries a quantum door in the language dossierwatching dr_door_quantum Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The photonic door: continuous-variable semantics as a dialect lowered to a CV simulator Open — watching `runtime/nx_door_lower_lib.nx` : `dr_door_photonic`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING dr_door_photonic (lang LN93): a CV dialect lowering a displacement-and-squeezing fixture to a sovereign CV simulator matched against the field's simulator; the field now has a formal CV semantics and Hoare logic [cvqc-verif-2607-17714]; no rival column carries one dossierwatching dr_door_photonic Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
The cluster door: multi-node placement through the mapper with a transport in the language Open — watching `runtime/nx_mapper_lib.nx` : `mp_map_cluster`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING mp_map_cluster (lang LN94): the mapper places tasks across nodes over a sovereign transport, the census fixture prints one checksum on one node and on N with the speedup printed; Rust and Go reach clusters through libraries (Part), never through placement in the language rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching mp_map_cluster Pros none measured yetCons behind Rust, Go; open contract; expected source declaration not established	○	◐	○	◐	○
The door census: one known-answer fixture built through every declared door, one receipt Source present; authored stronger claim: `dc_run_ladder` in `runtime/nx_door_census_lib.nx`, verified at emit. WATCHING dc_run_ladder (lang LN95): PASS, REFUSED-BY-NAME or ABSENT per declared door with the checksum, partition summing to the ladder; the doors category on the scorecard is written from this receipt; the frontier writes schedule and placement as solvable symbols [schedules-symbols-2609-29219] and enforces GPU kernel determinism in the compiler [gpu-bitwise-2609-11356]; no rival toolchain ships a door census Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
The arXiv digest: a mirrored listing read as rows by an estate organ Source present; authored stronger claim: `ad_digest` in `runtime/nx_arxiv_digest_lib.nx`, verified at emit. WATCHING ad_digest (lang LN96, built 2026-09-26): entry rows with published date, id tail, squashed title, categories and a bounded abstract head from the pinned bytes, an envelope naming every absence, population left to nx_arxiv_census; the read that used to happen in a laptop script now happens in the language, and no rival toolchain reads its own research listings Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Exact arithmetic organs: multi-precision integers and exact rationals Measured: `bi_copy` exists in `runtime/nx_bigint_lib.nx`, verified at emit. The organs exist (nx_bigint_lib, nx_rational) and are not yet language notation: the sota Domain reach row binds here and reads Part until LN83 lands; Zig (std.math.big) and Go (math/big) carry it in the standard library, Rust and Elm in packages or not at all rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	●	●	○
Symbolic integration and series organs Measured: `nx_calc_integrate` exists in `runtime/nx_calc_integrate.nx`, verified at emit. The symbolic integration engine and the Taylor series engine exist as organs; the sota Domain reach row binds here and reads Part until LN83; the bar is the SymPy parallel Risch-Norman result of 49 of Charlwood's 50 integrals [sympy-charlwood-2609-25616]; no rival column carries symbolic algebra in the language Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	○	○	○	○
SI units and dimensional analysis organ Measured: `nx_dim_new` exists in `runtime/nx_units.nx`, verified at emit. The SI units and dimensional-analysis engine exists as an organ; the sota Domain reach row binds here and reads Part until LN83 makes a unit mismatch a compile refusal; no rival column types units in the language Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	○	○	○	○
Molecule graph and SMILES organs Measured: `nx_chem_mol_new` exists in `runtime/nx_chem_molecule.nx`, verified at emit. The molecule graph, SMILES parser and SMILES emitter exist as organs; the sota Domain reach row binds here and reads Part until LN86; no rival column carries chemistry in the language Adoption: `LIB-WIRED importers=32 nonval=15` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Null enforcement: pointer parameters non-null by type, nullability declared DARK — `runtime/nx_option_enforce.nx` EXISTS but does not declare `opt_param_nonnull`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCHING opt_param_nonnull (lang LN97, admitted 2026-09-26 from the corrected checked-mode census: 8330 of 8817 counted safety-ring refusals are the null mode refusing dereferences of PARAMETERS the estate never null-checks); the rung flips the proof rule to the Kotlin, Swift and Rust default -- a pointer parameter is non-null by type and the caller proves it, only a declared nullable pointer is checked at its use -- and the cell flips when nx_option_enforce carries that rule; graded by the --optenforce refusal count over the whole population rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching opt_param_nonnull Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract; expected source declaration not established	○	◐	◐	●	◐
Every parser refusal carries a location, a caret and a fix (lang LN46) Measured: `nx_diag_organ_at` exists in `runtime/nx_parse.nx`, verified at emit. LANDED 2026-09-03: every token passes through advance_tok, which records line and col at that one chokepoint, so parse_die and its two raw-write siblings (35 sites) print file, line, caret and fix through nx_diag_organ_at without touching a call site. Row admitted 2026-09-27 because the rung's symbol had named a function nobody built (nx_pd_line) and read UNMAPPED; the real entry point is measured here. rustc and Elm remain the bar (Best): structured suggestions with machine-applicable fixes; ours names the fix in prose. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=62 nonval=58` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Elm (leads)	●	◉	●	●	◉
Mode fit
the container's measured envelope chooses the mode (lang LN69) Open — watching `runtime/nx_lang_modefit_lib.nx` : `lm_fit_mode`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING lm_fit_mode (lang LN69, operator 2026-09-22: water in a container). No rival chooses its compile mode from the container's measured envelope; each ships fixed optimisation levels a human picks. The contract: read the tier ladder rows (cores, memory pages, thermal and energy budget, latency floor) and nx_energy_probe where present, and answer the mode with the rows that decided it. Row admitted 2026-09-27 so the rung stops reading UNMAPPED; the organ does not exist yet, so the cell is OPEN. dossierwatching lm_fit_mode Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Verifier-in-the-loop compiler door (lang LN61) Open — watching `runtime/nx_verify_loop_lib.nx` : `vl_retry_until_green`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCHING vl_retry_until_green (lang LN61): a machine-readable refusal plus a retry protocol a local engine drives until the gate is green, the September-2026 shape [eiffeltools-2609-03086]. No rival toolchain ships its verifier as a retry loop for a code-producing engine. Done-rule is measured by the incumbent nx_build_firsttry_lib, never a new ruler. Row admitted 2026-09-27 so the rung stops reading UNMAPPED; organ absent, cell OPEN. dossierwatching vl_retry_until_green Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Regression corpus with directives, the lit-class runner Open — watching `runtime/nx_lit.nx` : `tr_lit_run`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. ABSENT 2026-09-28: LLVM tests its compiler on the annotated regression corpus under llvm/test run by lit, one file per bug or feature [llvm-testing-guide]; Kotlin's K2 reuses one annotated corpus across every target [kotlin-k2-story]; the estate has fixtures and gates but no corpus format, no directive language and no runner. Rival cells graded from public knowledge (the Rust compiletest UI corpus, the Zig and Go test directories, elm-test), mirrors owed. LN98 dossierwatching tr_lit_run Pros none measured yetCons behind Rust (leads), Zig, Go, Elm; open contract; expected source declaration not established	○	◉	●	●	●
Golden-dump pattern checking per pass, the FileCheck class Measured: `tr_dumpcheck` exists in `runtime/nx_dumpcheck.nx`, verified at emit. ABSENT 2026-09-28: no CHECK-line matcher over the IR dump or the emitted assembly; the VECRED and BCK-ELIDE lines narrate passes and nothing matches them [llvm-testing-guide]. LN99 Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use) Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons behind Rust (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use)	●	◉	●	●	○
Random well-defined program generation for differential testing, the Csmith class Measured: `pg_generate` exists in `runtime/nx_progen_lib.nx`, verified at emit. ABSENT 2026-09-28: the equivalence net runs 10 fixed corpus rows; no generator exists, while the field generates by dialect and by liveness [arxiv-compiler-testing-2026-08] [cpplinks-compilers]. LN100 Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	○	●	○
Conformance corpus per specification clause DARK — `runtime/nx_langspec.nx` EXISTS but does not declare `ls_clause_tests`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ABSENT 2026-09-28: the specification has no clause-to-program map; the Fujitsu suite is the shape [fujitsu-cts-readme]. LN101 dossierwatching ls_clause_tests Pros none measured yetCons behind Rust (leads), Zig, Go (leads), Elm; open contract; expected source declaration not established	○	◉	●	◉	●
Whole-program performance suite with reference outputs and tracking, the LLVM test-suite class DARK — `runtime/nx_lang_h2h.nx` EXISTS but does not declare `tr_perf_suite`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ABSENT 2026-09-28: one workload on the receipt against a suite of whole programs with reference hashes and LNT tracking [llvm-testsuite-guide]. LN102 dossierwatching tr_perf_suite Pros none measured yetCons behind Rust (leads), Zig, Go (leads); open contract; expected source declaration not established	○	◉	●	◉	○
Translation validation of optimizer rewrites, the Alive class DARK — `runtime/nx_opt_eqsat_pass.nx` EXISTS but does not declare `tv_validate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ABSENT 2026-09-28: the e-graph oracle validates its own rule table and the reduction gate validates one pass by a scalar twin; no per-rewrite validator [cpplinks-compilers]. LN103 dossierwatching tv_validate Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Mined bug shapes steering generated and regression tests Open — watching `runtime/nx_bugmine.nx` : `bm_mine_shapes`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. ABSENT 2026-09-28: the estate's own defect record and the field's bug studies are read by seats, never by an organ [arxiv-compiler-testing-2026-08]. LN104 dossierwatching bm_mine_shapes Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Real-world corpus as the release gate, the crater class DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `tc_corpus_run`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ABSENT 2026-09-28: the census counts refusals per mode; it does not build and run the population per candidate toolchain [llvm-testsuite-guide]. LN105 dossierwatching tc_corpus_run Pros none measured yetCons behind Rust (leads), Go; open contract; expected source declaration not established	○	◉	○	●	○
Sovereign test-case reduction, the C-Reduce class Open — watching `runtime/nx_reduce.nx` : `tr_reduce`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. ABSENT 2026-09-28: failing programs are shrunk by hand [cpplinks-compilers]. LN106 dossierwatching tr_reduce Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Defect-class ledger joined to the public exploit and weakness record Open — watching `runtime/nx_hazard_census.nx` : `hz_census`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH hz_census (lang LN109, milestone M10, admitted 2026-10-03). One row per defect class with its CWE ids, its state in the language and its standing in the public record: CISA's exploited catalog tags every entry with its weakness [cisa-kev-2026-10] and MITRE ranks the classes yearly [cwe-top25-2025]. The board's existing ledger row grades the estate's own taxonomy; this one grades against the outside record. Rival cells are unassessed: no pinned source for a rival-maintained class ledger was read dossierwatching hz_census Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Resource budgets: sizes derived or budgeted, over-limit a typed outcome (CWE-770 and CWE-400 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `budget_check_alloc`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH budget_check_alloc (lang LN110). Rust's reference lists leaks of memory and other resources among the behaviours it does not consider unsafe [rust-ref-not-unsafe]; the Cloudflare outage of 18 November 2025 was a preallocated 200-feature limit met by a larger file and an unwrap on the error [cloudflare-outage-2025-11-18]; allocation without limits entered the 2025 Top 25 at rank 25 [cwe-top25-2025]. Zig, Go and Elm cells are unassessed by a pinned source dossierwatching budget_check_alloc Pros none measured yetCons open contract; expected source declaration not established	○	○	?	?	?
Loop termination evidence: a proven variant or spent fuel (CWE-835 class) DARK — `runtime/nx_bck_elide.nx` EXISTS but does not declare `term_check_loop`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH term_check_loop (lang LN111). The kernel's eBPF verifier disallows loops in its first step, before any program loads [kernel-bpf-verifier]; the month's cs.PL listing proves the common fixpoint-detection strategy unsound and gives a sound and complete detector (2610.00530) [arxiv-cspl-2026-10]. The induction facts LN17 and LN20 already compute are the proof for counted loops. Rival cells are unassessed by a pinned source dossierwatching term_check_loop Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Deadlines on every blocking call (CWE-833 and CWE-667 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `wait_deadline_required`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH wait_deadline_required (lang LN112). Deadlocks head the list of behaviours Rust's reference does not consider unsafe [rust-ref-not-unsafe]. The estate's own record: a daemon start that slept on a registry lock for eight minutes and a slot pool wedged behind a dead holder. Zig, Go and Elm cells are unassessed by a pinned source dossierwatching wait_deadline_required Pros none measured yetCons open contract; expected source declaration not established	○	○	?	?	?
Lock order by level (CWE-833 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `lock_level_check`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lock_level_check (lang LN113). A lower lock taken while a higher one is held is refused at compile time for every statically named lock; Rust's reference places deadlocks outside what it prevents [rust-ref-not-unsafe]. Zig, Go and Elm cells are unassessed by a pinned source dossierwatching lock_level_check Pros none measured yetCons open contract; expected source declaration not established	○	○	?	?	?
Errors must be consumed and no unwrap traps (CWE-252 and CWE-248 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `mustuse_check_result`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH mustuse_check_result (lang LN114). Rust is graded partial on its own incident: production Rust called unwrap on an error value and panicked a proxy fleet [cloudflare-outage-2025-11-18]; a null pointer with no error handling crash-looped a cloud control plane in every region [gcp-incident-2025-06-12]. Zig, Go and Elm cells are unassessed by a pinned source dossierwatching mustuse_check_result Pros none measured yetCons behind Rust; open contract; expected source declaration not established	○	◐	?	?	?
Counter and clock horizons declared and computed (the anti-Y2K class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `horizon_check_counter`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH horizon_check_counter (lang LN115). A software counter that overflows after 248 days of continuous power drew an airworthiness directive for every Boeing 787 [faa-ad-787-248d]; 248.55 days is 2 to the 31st hundredths of a second. The month's listing carries a unit calculus with conversion (2609.38242) [arxiv-cspl-2026-10]. Rival cells are unassessed by a pinned source dossierwatching horizon_check_counter Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Versioned checks on shared state: the act presents the check's token (CWE-367 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `stale_check_refuse`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH stale_check_refuse (lang LN116). The October 2025 AWS event was a check made at the start of applying a plan and stale by the time an older plan was written over a newer one [aws-event-2025-10-19]. The estate's file door already refuses a write whose expect token is stale; this makes it the language's rule. Rival cells are unassessed by a pinned source dossierwatching stale_check_refuse Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Injection refused by typed sinks and tainted input (CWE-78, CWE-77, CWE-89 and CWE-79 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `sink_typed_builder`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH sink_typed_builder (lang LN117). OS command injection carries 110 tags in the exploited catalog against 105 for out-of-bounds write, and cross-site scripting and SQL injection are ranks 1 and 2 of the 2025 Top 25 [cisa-kev-2026-10] [cwe-top25-2025]; memory safety does not touch the class. Rival cells are unassessed by a pinned source dossierwatching sink_typed_builder Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Length-carrying strings by default (CWE-170 and CWE-126 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `str_slice_default`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH str_slice_default (lang LN118). The estate inherited scan-to-terminator strings and its 2026-07-08 over-read was this class; slices are bounds-checked today and the string surface over them is the rung. Rival cells are unassessed by a pinned source and are expected to lead: this is a catch-up row dossierwatching str_slice_default Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Retry with a budget and jitter (the retry-storm class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `retry_budget_required`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH retry_budget_required (lang LN119). Restarting tasks with no randomized exponential backoff overloaded the datastore during the June 2025 recovery [gcp-incident-2025-06-12]. Rival cells are unassessed by a pinned source dossierwatching retry_budget_required Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Implicit conversions refused (CWE-704 and CWE-843 class) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `coerce_refuse_implicit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH coerce_refuse_implicit (lang LN120). Type confusion carries 38 tags in the exploited catalog [cisa-kev-2026-10]. The estate spells its casts by hand; the rung is the proof that the compiler refuses the alternative. Rival cells are unassessed by a pinned source dossierwatching coerce_refuse_implicit Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?
Research watch for this ladder with no seat: scoped sources, watched rows, proposals on a clock Measured: `fs_src_applies` exists in `runtime/nx_frontier_scan.nx`, verified at emit. WATCH fs_src_applies (lang LN121). The scanner attests every bar daily and re-earned this board's twelve bars by itself on 2026-10-03; it does not scope sources by board (204 fetches, most to graphics venues), scans only rows where a named rival leads, and its propose verb is on no clock. No rival language ships a board that tracks its own design research Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	99	rows carrying a Yes, Best or Part in a rival column
cited	37	a reference mark resolves to a pinned mirror
uncited	62	an observation read, badged until a reference lands
rows, summed	99	RECONCILED: the parts sum to the total 99

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-03	LN6	measure	The ranker moved LN6 to #1 once LN29 closed (target 2.0, M3). Measured the boundary first: nx_pool_submit(pool, fn, ctx: i64) has 40 call sites in 22 files; ~30 pass `p as i64` where p points at a per-task struct, the rest an integer or an address already in i64. The cast erases the type, so no marker anywhere says whether the struct may be read on the worker thread -- that is the CWE-362 hole the matrix row names. runtime/nx_sync_types.nx (the row's organ) never existed on either tree; the check lives in the parser, matrix organ repointed
2026-09-03	LN6	land	sync_send_check in nx_parse.nx (the watch symbol) + the `send` marker: `struct Job send { ... }` records the author's assertion (Rust's unsafe impl Send); under --sendcheck a ctx argument to nx_pool_submit that is a cast FROM a pointer to an unmarked struct is refused in the teaching voice naming the struct and showing the marker; a plain integer, an address, or a cast from an untyped u8/i64 buffer is ABSTAINED and the imprecision is declared in the source. --sendcheck is a driver flag and joins the `checked` mode row (the control), NOT `daily`, until the corpus is marked. Default builds emit nothing under either mode. nx_sendcheck_gate (13 teeth, four runtime fixtures: unmarked refused, marked compiles, integer abstains, default-build unchanged) bite-proven RED 6/13 against the pre-LN6 compiler and GREEN 13/13 after nx_bless_compiler NEUTRAL; nx_cc_equiv_gate 10/10 plus self-host GREEN; LN29 and LN27 gates still GREEN. Sources CAS-landed on the NAS as hunks; NAS toolchain build + promote_toolchain + gate ship follow
2026-09-03	LN6	queue	Corpus census under --sendcheck is running on the laptop (every func-main program); its count is the marking worklist -- each refusal names a struct that crosses the pool unmarked and needs the author's `send` decision, never a blanket mark. When that list reads zero the ratchet may move --sendcheck into `daily`
2026-09-03	LN6	measure	WHOLE-CORPUS CENSUS under --sendcheck (no sampling): 7598 top-level programs, refusing=75, and the refusals collapse to SIX structs (the marking worklist is per STRUCT, one author decision each, never per program): NxFq4mCtx (nx_f32_q4k_matmul.nx, the Q4_K matmul task context -- 53 programs, the whole LLM closure) · NxGraphNode (2) · Q8Ctx · Q5Ctx · PgCtx · NxMmtCtx (1 each). The plain-integer ctx sites (nx_nofloat_llm, the pool gates) abstained as declared. NxFq4mCtx holds only a_ptr/b_ptr/c_ptr and row bounds: each task owns a disjoint [jlo,jhi) slice of C and reads A and B immutably after submit, so it is the textbook `send` case -- but the mark is the author's assertion and is left for the lane that owns the matmul, with this row as its evidence
2026-09-03	autodev	land	The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 1788405975 (sev 5) autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix
2026-09-03	autodev	land	The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 5 autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix
2026-09-03	LN6	land	TOOLCHAIN PROMOTED on the NAS with LN6 (fourth canaried promote of the day): /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e3d31613 919760 B (parse_field_of_struct + sync_send_check + the send marker + nxcx_log derived lengths); contentdiff live->staged lost_from_live=0. The outgoing LN29 compiler fa7d8c6e is copied to knowledge/bank (a second promote pushes it out of .prev). --sendcheck is live in the served compiler under the checked mode; daily is unchanged until the six structs are marked
2026-09-03	LN6	land	nx_sendcheck_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN against the promoted LN6 toolchain (the served compiler refuses the unmarked fixture by name, accepts the marked one, abstains on the integer, and the default build is unchanged), promoted b0b93fdd, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN6's done-rule (a non-Send value handed to nx_pool_submit is refused, gate-proven) is met; the rung stays honest about scope: the check is name-keyed on the pool's one submit function, abstains on untyped buffers, and the corpus is unmarked, so the mode is `checked`, not `daily`
2026-09-02	LN27	land	nx_diag_voice_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN in the PROVE stage (the NAS sources carry 0 bare sites too), promoted cf2f5a08, _offc twin installed, registered, and hand-added to knowledge/gateroster.conf with its evidence named -- the LN27 watch symbol is now declared in the organ the matrix row names and flips on the next regen
2026-09-02	LN24	measure	NAS built nx_compile_x86 from the landed sources (staged e6fe9cf6 913840 B, src_sha 68ebd245 = laptop, closure 5786cad0); nx_contentdiff live -> staged lost_from_live=2, both runs NAMED: the old LN25 assert-tag fragments (blocks pool exhausted in function / split it: the cap is blocks PER FUNCTION), superseded by the diag_capacity_named voice; the first /api/promote_toolchain of it was CANARY-BLOCKED (build admission refused the canary compile under the I/O storm) and auto-rolled back to ea0314ce -- an untested toolchain never goes live; re-aliased and retried once admission read GRANT
2026-09-03	LN24	land	TOOLCHAIN PROMOTED on the NAS: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e6fe9cf6 913840 B (the compiler with the measured-length expander walk, the first-wins desync recorder, diag_capacity_named and every voiced site), .prev = ea0314ce, the pre-session compiler 7a07a9cc kept in knowledge/bank. LN24, LN25 and LN27 are now live in the served compiler; their watch symbols are declared in the organs the matrix names
2026-09-03	LN29	land	parse_field_of_struct in nx_parse.nx is the ONE field resolver for x.f (the watch symbol; matrix row added, M1 ladder extended): a struct that declares fields and does not declare the named one is refused in the teaching voice naming the struct and the fields it really has; an unresolved stub (n_fields 0) keeps the silent return-base path the self-build relies on. Fixture p.c on Pair{a,b} reads error at _fx_ln29_bad.nx:6: struct Pair has no field named c, with caret, why and fix (a, b); the control compiles; nx_cc_equiv_gate 10/10 plus self-host GREEN; the voice gate counts the new site voiced (25/25 parser sites). Source CAS-landed on the NAS (four hunks). NOT promoted yet: a whole-corpus refusal census (every top-level program under the new compiler) runs first, then the canaried promote_toolchain
2026-09-03	LN29	measure	The first refusal the new compiler found was real and instructive: nx_tls13_server_session_recv_ch and emit_sh read and write session.client_offered_sup_ver, which the LAPTOP copy of Tls13ServerSession never declared -- every write landed at offset 0 of the session and every read saw a non-zero pointer -- while the NAS copy had declared it in the 2026-07-31 TLS-1.2 interop fix. Converged by adopting the NAS bytes (sha a05226d2); equiv GREEN again. Lesson: a laptop tree behind the NAS reads exactly like a compiler defect; converge the file before diagnosing the compiler
2026-09-03	LN27	land	nxcx_log in nx_compile_x86.nx now DERIVES every message length from the NUL-terminated literal instead of trusting the hand-counted second argument: an audit of its fourteen call sites found six counts that disagreed with the literal beside them (111 vs 114, 129 vs 131, 40 vs 38, 35 vs 34, 37 vs 36 twice) -- the small ones truncated the sentence, the large ones leaked the bytes after the literal into stderr (the expand_imports line printed two stray bytes before its why line). One chokepoint fix, no call-site change; the redundant nxcx_log(name, 0) before the explicit mode-name write removed; equiv 10/10 plus self-host GREEN, voice gate GREEN; source pushed to the NAS under CAS, rides the next toolchain build
2026-09-03	LN29	land	nx_field_of_struct_gate (source on the NAS, organ_kind oracle): assembles fx_bad (p.c on Pair{a,b}) and fx_ok in /tmp/nx_field_of_struct_gate/, forks the PROMOTED compiler on each with stderr captured, 11 teeth. BITE-PROVEN in the honest direction: against the pre-LN29 laptop compiler the bad fixture compiled rc=0 and six teeth went RED (the silent miscompile, measured); after nx_bless_compiler NEUTRAL installed the LN29 compiler (equiv + self-host green, game gate 127==127) the gate reads 11/11 GREEN. On the NAS it must stay UNSHIPPED until the LN29 toolchain is promoted -- its PROVE stage forks buildroot/_offc/nx_cc_sovereign.elf, which is still the pre-LN29 build; shipping it earlier would be a RED gate on a correct subject
2026-09-03	LN29	measure	WHOLE-CORPUS REFUSAL CENSUS (no sampling): every top-level program under runtime/ (7598 with a func main) compiled by the LN29 compiler on the laptop; refusing=1 and that one is the planted fixture _fx_ln29_bad.nx itself (removed from the tree afterwards). Zero real refusals: the corpus builds unchanged under the new rule, which is the done-rule's second conjunct. The compiler is therefore safe to promote estate-wide; the promote waits only for the queued NAS build that also carries the nxcx_log derived-length fix
2026-09-03	LN29	land	TOOLCHAIN PROMOTED on the NAS with LN29: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = fa7d8c6e 915752 B (parse_field_of_struct live in the served compiler: an undeclared field on a declared struct is now a refusal estate-wide, proven safe by the 7598-program census). The pre-change compilers are durable in knowledge/bank (7a07a9cc pre-session, e6fe9cf6 voiced); the driver's derived-length nxcx_log rides the queued BQ-nx_compile_x86 build and its own canaried promote (admission refused three direct issues under the storm; the queue fires it)
2026-09-03	LN29	land	nx_field_of_struct_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 11/11 GREEN against the promoted LN29 toolchain (the served compiler refuses the undeclared field by name and compiles the declared control), promoted 9e4f9a03, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN29 is DONE by its own done-rule: fixture refused with the struct and its real fields named (gate), corpus builds unchanged (7598-program census); the watch symbol parse_field_of_struct is declared in nx_parse.nx and the M1 ladder carries the rung

Risk register

Risk	Likelihood x impact	Mitigation
Any optimizer or backend change that promotes without the equivalence net ships a silent miscompile	certain x high	LN7 and LN8 done-rules require nx_cc_equiv_gate 10/10 plus self-host GREEN before promote_toolchain -- the canaried lane, never a hand copy.
Safety checks on by default break the 13,201-source corpus overnight	likely x high	LN1-LN6 ship behind a declared mode with the corpus building unchanged under the default; the ratchet flips the default per class only when the corpus is clean.
Complexity creep erodes the adoption exceed	possible x high	The Rust record is the control: every added annotation or keyword is weighed against the community's measured complexity fear; the capability-limit voice teaches instead of gatekeeping; the explicit-types stance stays.

Release history continued

When	Rung	Kind	Entry
2026-09-02	LN24	measure	nx_probe_hexesc: len=002 b0=195 b1=169 -- a high-byte hex escape in a string literal yields the two bytes; the earlier desync was a raw NUL written into source by a shell heredoc that collapsed the escapes, not a lexer gap
2026-09-02	LN25	measure	nx_html_entities: 112 names compiled; 253 names in one function overflowed ir_block_new at 4096 blocks; split by name length (2..8) the same 253 names compile
2026-09-02	LN24	land	Source-landed on the laptop in nx_tokenizer.nx (the lexer nx_compile_x86 actually imports; lex.nx is a test-only twin and was left byte-identical) plus the report in nx_compile_x86.nx: a planted NUL inside a literal now reads 'error at fx_nul.nx:3: the string literal opened at column 18 is never closed' and a planted 0x01 outside a literal reads 'error at fx_ctl.nx:3: a control byte (decimal 1) sits in the source at column 19', both file:line mapped, both fatal before the parser runs; nx_cc_equiv_gate 10/10 rows PASS plus self-host PASS verdict GREEN on the challenger. Awaiting the NAS toolchain build and promote_toolchain canary
2026-09-02	LN25	land	ir_block_new now builds its assert tag on the failing path only, naming the function (blocks pool exhausted in function <name> -- split it); a 2,300-branch fixture trips it at idx=4096 and names big. Same challenger, same equivalence verdict
2026-09-02	LN24	lesson	Statics are module-private in NishiLang: nx_compile_x86 could not see lex_err_kind ('I do not know the name'); accessor functions are the cross-module surface. And a one-line while/if with a struct-field index inside a braces chain tripped the tokenizer's @concat macro path ('@concat produced ...'); the plain multi-line form compiles -- a lexer-level hazard worth its own rung if it recurs
2026-09-02	LN24	retract	The lesson row above claimed a one-line while/if with a struct-field index tripped the tokenizer's @concat path. A minimal fixture (fx_concat.nx, one-line and multi-line forms) compiles rc=0 with the baseline compiler, so the claim is withdrawn: the message arose from an intermediate edit of nx_ir.nx, not from that construct
2026-09-02	LN24	queue	The teaching-voice report lives in nx_compile_x86.nx (the driver the laptop and the PE lane build) and the tokenizer/IR changes are shared; the NAS built nx_compile_x86 once admission opened, but /api/promote_toolchain accepts only nx_cc_sovereign, nxasm_x86_main or nx_sov_build_run, and this seat could not locate the sovereign compiler's driver source (no nx_cc_sovereign.nx under buildroot/runtime or its siblings; nx_catalog answered nothing under load). OWED to the lang lane: port the same report block to the sovereign driver's lex_source call site, build it, promote_toolchain; the tokenizer statics and accessors it needs are already on the NAS
2026-09-02	LN24	retract	The two LN24 messages as first landed state the fact without the estate's teaching voice (the parser's own errors print the offending line with a caret, then why-the-build-stopped and fix lines). The operator named them as output that does not help a programmer grow. Rewritten the same hour to that shape on the laptop and as a NAS hunk; the estate-wide standard is LN27 and belongs to the lang lane
2026-09-02	LN28	land	the intrinsic shipped as five anchored edits to the toolchain sources on both trees (nx_types, nx_ir, nx_parse, nx_x86_64_ctx twice, nx_x86_regalloc) plus nx_q4k_dot_simd2_lib and nx_q4k_simd2_gate; the laptop compiler is blessed (sha a9480db0), the NAS compiler waits on its own promote_toolchain canary under build admission; a consumer built with the old compiler fails to COMPILE rather than silently falling back, which is why the simd2 kernel lives in its own lib
2026-09-02	LN28	measure	nx_q4k_simd2_gate timing over 2000 rows of 14 super-blocks: simd (scalar unpack) 14.0 ms, simd2 (emitted unpack) 3.55 ms, 3.94x; the first gate run read 8 of 9 because the neg-control fixture drew a zero sub-block scale on 1 of 200 rows and a flipped nibble under a zero scale is arithmetically invisible -- the fixture now draws every scale non-zero and the zero-scale case stays covered lane-level
2026-09-02	LN28	lesson	the compiler emits intrinsics as raw VEX byte sequences, so a new AVX2 primitive never needs an assembler mnemonic; the encoding is proven by the consumer gate against an exact reference, never by inspection alone
2026-09-02	LN11	land	nx_lsp_gate ran 19 of 19 GREEN on the NAS through nx_job_run and is now ON THE GATE ROSTER (nx_gate_roster_run trial 3 of 3 green_or_skip, admit admitted_new=3); the language server had been REGISTERED-DARK since it shipped, a mention not a run
2026-09-02	LR3	land	nx_pkg_gate 19 of 19 GREEN on the NAS (CAS resolve, typosquat refused, zero install-time execution, hash-chained journal) and admitted to the roster with nx_gdbstub_gate (SKIP: stock gdb absent on the NAS, a precondition not a defect)
2026-09-02	LN9	queue	nx_srcfmt, nx_dbg_step_gate and nx_rvc_gate stay REGISTERED-UNAUTHORISED: no cap was ever minted for them, so no seat can run them; the unblock is one admin mint per tool (POST /api/cap/mint allow=<tool>), an admin-seat action, not more code
2026-09-02	LN9	land	the mint happened from the seat: a 30-day union cap for 14 lang and OS tools via POST /api/cap/mint with the banked admin cap; nx_srcfmt_gate 13 of 13 GREEN on the NAS through nx_job_run and admitted to the gate roster; nx_srcfmt now reads LIVE in nx_catalog
2026-09-02	LN12	land	nx_dbg_step_gate 29 of 29 GREEN on the NAS (statement stepping over an nx_dwarf_line table, never-brick teeth: zero ptrace call sites, a pid-shaped subject refused) and admitted to the roster; nx_dbg_step reads LIVE
2026-09-02	LN10	land	nx_inc_compile_gate 40 of 40 GREEN on the NAS (one ruler with nx_closurehash, corrupt index refused whole, toolchain-byte change misses) and admitted to the roster; inc_cache_lookup was REGISTERED-DARK since it shipped
2026-09-02	LR5	land	nx_langspec_gate 30 of 30 GREEN on the NAS (spec_conformance_run over the shipped compiler, absent-compiler abstains, clause coverage at the ratchet) and admitted to the roster
2026-09-02	LR6	queue	nx_osattest and nx_lang_h2h are now AUTHORISED under the same cap and still dark: their gates (nx_osattest_gate, nx_lang_h2h_gate) have not been run through the job runner and admitted yet, the same two-call recipe as above
2026-09-02	LN26	land	hc_build_debug_armed() in nx_hostctl cmd_buildrun appends --debug to the runner argv whenever knowledge/status/build_debug.flag reads 1 (flag written 1 this leg, data-driven disarm by writing 0); compile-proven locally with the hostctl change; NAS hostctl build queued BQ-nx_hostctl; the chain itself is proven on the NAS by nx_dwline_e2e_gate GREEN 21/21 (nx_cc -g, nxasm DWARF v5 .debug_line past the loaded image, nx_addr2line); remaining done-rule conjuncts: the first promoted --debug build answers nx_addr2line on the deployed binary and the byte-identity censuses accept the appended table
2026-09-02	LN24	retract	The LN24 attribution as first landed could not fire on a NUL inside a user file: nx_import expand_imports_inner walked every file as a NUL-terminated string (while src[p] != 0), so a raw NUL silently dropped the rest of that file before the lexer saw a byte of it and the open literal ran into the auto-appended nx_crash.nx -- the measured symptom, reproduced on the promoted compiler with a NUL-in-literal fixture (twenty errors at nx_crash.nx:36)
2026-09-02	LN24	land	nx_import.nx now walks by measured length (let n = *len_out; while p < n) in all four loops, so the NUL reaches the lexer; diag_desync_origin(kind, line, col, byte) in nx_tokenizer.nx is the ONE first-wins recorder and the watch symbol (matrix organ repointed from the lex.nx test twin to nx_tokenizer.nx); the fixture now reads error at _fx_ln24_nul.nx:3: the string literal that opens at this column is never closed, with caret, why and fix, and the control-byte fixture reads error at _fx_ln24_ctl.nx:3 (decimal 1); nx_cc_equiv_gate 10/10 plus self-host GREEN on the challenger
2026-09-02	LN25	land	diag_capacity_named(pool, name, name_len, measured, cap, remedy) in nx_ir.nx is the one voice for every capacity cap (blocks, SSA values and instructions PER FUNCTION; functions and globals PER UNIT): error at function <name>: the <pool> capacity is reached -- measured N against a cap of C, then why the build stopped and fix, exit 2; a 4200-arm fixture reads error at function big: the basic-block pool (blocks PER FUNCTION) capacity is reached -- measured 4097 against a cap of 4096
2026-09-02	LN25	lesson	f.name_bytes compiled on a *Function although Function declares name_start and name_len: the parser resolves a struct field by NAME across every struct, so a field of another struct reads garbage at a wrong offset with no diagnostic (the function name printed as junk until the fixture caught it). Admitted as LN29 below
2026-09-02	LN27	land	nx_diag_voice_gate.nx (symbol diag_voice_gate; matrix organ repointed to the gate): a census over 8 toolchain sources -- a site is a call to nx_diag_at or nx_diag_organ_at, an error: literal, an nxcx_log(nx_compile_x86: ...) line, an nxasm: FATAL literal or an error at function literal outside comments and definitions; a site is voiced when a why line (why the build stopped, why this matters, or an nx_diag_why_ call) AND a fix line (fix: or an nx_dym_note call) appear within 60 lines before the next site -- and it ratchets knowledge/status/diag_voice_ratchet.conf per file (tightens on a fall, never rewrites on a rise, prints BARE file:line as the worklist). Measured: 37 sites, 30 voiced, 7 bare at first sight; all 7 voiced this leg (parser too-many-problems, argument type mismatch, unreachable arm, non-exhaustive match, the build-found-N summary; the driver crash-guard-missing and validator notices; every bare driver failure and both assembler FATAL sites) -> 37/37 voiced, bare 0; gate 12/12 GREEN on the laptop, bite-proven RED 11/12 by deleting one fix line (names nx_compile_x86.nx:383 no-fix RISE) and GREEN again on restore
2026-09-02	LN24	measure	toolchain promoted on the NAS through /api/promote_toolchain (canary GREEN, .prev banked, pre-change compiler banked to knowledge/bank/nx_cc_sovereign.elf.pre-ln24ln25-7a07a9cc, verified 803170 B): live buildroot/_offc/nx_cc_sovereign.elf is ea0314ce 900368 B and carries the first LN24/LN25 hunks; the expander fix, the recorder and the voice edits are source-landed on the NAS under CAS and await the next toolchain build plus canary
2026-09-02	LN27	queue	NAS: build nx_compile_x86 from the landed sources, nx_stage_alias alias nx_compile_x86 elf.new nx_cc_sovereign, /api/promote_toolchain target=nx_cc_sovereign.elf (canary, auto-rollback), then nx_organ_ship nx_diag_voice_gate so the LN27 watch flips on the next regen; laptop proof GREEN already (equiv 10/10 plus self-host, voice gate 12/12, both fixtures)
2026-09-03	LN30	measure	nx_autofix_intake_gate printed proposed=15 kept=0 discarded=15 unexamined=15: its REFUSED-else closed one line late so `} else { SANDBOX-BUILD-FAILED }` hung as a second else, and the pre-LN30 compiler swallowed the `else {`, let that brace stand in for the missing one, and compiled the block as UNCONDITIONAL code (silent-class fixture: exit 0, 10,644 B of asm). The loud class (no missing brace) died on the module-level assert instead -- which names the wrong cause. Local corpus census over every program in the tree with the LN30 compiler: only the two planted fixtures refuse (final count lands in the promote row)
2026-09-03	LN30	land	parse_stmt dispatches TK_ELSE to parse_stmt_dangling_else (refusal voice: where + why + fix, recovery parses the block so later errors still surface); nx_parse.nx a5643d0f on BOTH trees (CAS); NAS toolchain BUILT 3697bb30 (920,944 B) staged as nx_cc_sovereign.elf.new, contentdiff vs live lost_from_live=0 over 2,146 runs, live compiler banked knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613 (919,760 B verified); laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green); nx_dangling_else_gate 14/14 GREEN vs the LN30 compiler and 7/14 RED vs the banked pre-LN30 compiler (bite-proven); gate source on the NAS, organ_kind oracle row, gateroster row, lang.matrix LN30 watch row, M1 ladder carries LN30. Intake gate itself fixed (brace) + T6 partition tooth and SHIPPED 84ec4b35 (6/6)
2026-09-03	LN30	queue	promote_toolchain target=nx_cc_sovereign.elf (canary) once the local census finishes clean, then nx_organ_ship nx_dangling_else_gate against the promoted compiler and roster it. LN31 candidate: the loud class and a module-level `var x: T = ...` both die on the STATEMENT-AT-MODULE-LEVEL assert whose text blames a brace -- module-level state is `static name: type`, and the compiler should say so
2026-09-03	LN31	measure	Two shapes died on the STATEMENT-AT-MODULE-LEVEL assert that blamed ONE BRACE TOO MANY: the loud dangling-else fixture (exit 200) and a module-level `var g_of_gv: i64 = 0` written while migrating the office gate onto nx_gate_verdict (braces balanced; module state is `static name: type`). The message named a cause that was not there
2026-09-03	LN31	land	the assert site now calls parse_module_stray_keyword (per-keyword voice, caret, why, fix, nx_diag_note_error, parsing continues); nx_parse.nx 089e9c8c on BOTH trees; laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green) for LN30+LN31 together; nx_dangling_else_gate 20/20 vs the new compiler and 10/20 RED vs the banked pre-LN30 compiler (module-var teeth included); lang.matrix LN31 watch row; ONE canaried toolchain promote carries LN30+LN31
2026-09-03	LN30	measure	Corpus census with the LN30 compiler over 13,774 programs (every func main under runtime/, laptop tree == NAS for the compiler closure): 2 refusals = the planted fixture + ONE real offender, runtime/_hdl_build/nx_archive_daemon.nx:500 -- a live daemon whose `} else { sys_close(cfd) }` hung as a second else on the /preserve route chain with main one brace short; the old parser ran sys_close after every routed request and never on a malformed one (fd leak). Fixed on both trees (44,457 B, both arms close), NAS build queued; the LN31 census runs next
2026-09-03	LN30	queue	nx_archive_daemon: fixed source built on the NAS (2,056,536 B debug-armed, sha 63759023) and staged as nx_archive_daemon.elf.new; /api/promote refused it as unclassified, so it is now declared `daemon` in organ_kind.conf -- which routes it to the health-checked /api/deploy. It is not a running service today, so bringing it up is an OPERATOR decision; the staged binary carries the fd-leak fix and waits there
2026-09-03	LN31	measure	LN31 census with the LN30+LN31 compiler over 13,781 programs: 8 refusals = 3 planted fixtures + 5 estate sources, and ALL FIVE already died under the pre-LN30 compiler on the module-level assert (exit 200) -- runtime/_hdl_build/nx_andelinwest_build.nx, nx_dev_pipeline_test.nx (an `if` at module level, line 81), nx_team_roster.nx (a `let` at module level, line 70), nx_vcodec_neural_entropy_gate.nx, nx_xlsx.nx. Zero NEW refusals from the promote; LN31 only names their cause. nx_xlsx.nx is the office xlsx writer whose promoted binary therefore cannot be rebuilt from this source (AHEAD class) -- a worklist row, not a promote blocker
2026-09-03	LN31	queue	repair the five module-level sources (each now prints where/why/fix): nx_xlsx first (the office depends on its promoted fossil), then nx_dev_pipeline_test, nx_team_roster, nx_andelinwest_build, nx_vcodec_neural_entropy_gate; re-run the census to zero real refusals
2026-09-03	LN30	land	TOOLCHAIN PROMOTED (LN30+LN31, one canaried promote): live buildroot/_offc/nx_cc_sovereign.elf = 4d8e7a40 / 923,280 B (the debug-armed mgmt build; contentdiff vs the previous live lost exactly the 3 removed assert strings), .prev = e3d31613 / 919,760 B (the pre-LN30 live, also banked at knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613). The executed promote's edge reply was a 503 and the client retry read `no valid staged .new` -- the live hash and the rollback slot are the witnesses, not the receipt. nx_dangling_else_gate then SHIPPED against the promoted compiler: prove 20/20 GREEN (the behavioural canary), promoted e8a97dab, REGISTERED, rostered
2026-09-03	LN32	measure	The LN31 census named three sources refusing at module level for the SAME reason: an inline decimal printer `{ let d: *u8 = sys_mmap(8); var m ... }` used twice per function. The parser had no bare-block production -- `{` fell into the expression fallback and its `}` closed the function early -- so nx_dev_pipeline_test, nx_team_roster and nx_andelinwest_build had never compiled. The fourth, nx_vcodec_neural_entropy_gate, was a module-level `let F_ZERO` (now const). All four compile under LN32
2026-09-03	LN32	land	parse_stmt dispatches TK_LBRACE to parse_stmt_block (block_base/n_locals saved and restored, the for-body discipline); nx_parse.nx 00e0d57c on BOTH trees; fixture returns 31 at runtime; laptop bless NEUTRAL BLESSED+VERIFIED 0c550d99 (cc_equiv corpus+self-host green); nx_dangling_else_gate 24/24 vs the LN32 compiler and 12/24 RED vs the banked pre-LN30 compiler; lang.matrix LN32 watch row; M1 ladder carries LN32; LN32 census running; NAS debug-armed toolchain build in the next admission grant, then ONE canaried promote
2026-09-03	LN32	measure	LN32 census with the LN30+LN31+LN32 compiler: 13,780 programs, ZERO refusals -- the four block-idiom and module-const sources now build, the laptop xlsx copy is converged to the NAS bytes, and no planted fixtures remain in the tree
2026-09-03	LN32	land	TOOLCHAIN PROMOTED (LN30+LN31+LN32, second canaried promote of the session): live buildroot/_offc/nx_cc_sovereign.elf = a5702510 / 923,648 B (debug-armed mgmt build; contentdiff vs the previous live lost_from_live=0 over 2,160 runs), .prev = 4d8e7a40 / 923,280 B (also banked at knowledge/bank/nx_cc_sovereign.elf.ln30ln31-4d8e7a40, verified), canary GREEN in the receipt this time. nx_dangling_else_gate re-shipped against the promoted compiler: 24/24 GREEN, promoted a0859551, registered, rostered. LN30, LN31 and LN32 are DONE by their done-rules; nx_xlsx shipped f542ca90 through its fixed gate (office referee 2/2 GREEN); nx_archive_daemon fix staged behind an operator deploy decision
2026-09-03	LN31	retract	The earlier measure row called nx_xlsx an AHEAD fossil. WRONG SUBJECT: the census ran over the LAPTOP tree and the laptop copy of _hdl_build/nx_xlsx.nx was stale and carried an extra brace; the NAS copy has no such brace and compiles under the new compiler. The two copies are forked 42 hunks both ways (NAS: XF_MAGIC hoist + shared emitter migration; laptop: a different OF-S6 CF/DV block). Before naming an estate file broken, hash the NAS twin. Adoption direction is decided by nx_contentdiff of the promoted _offc/nx_xlsx.elf against a fresh NAS build, not by copy
2026-09-03	LN	measure	nx_dwline_stmt_gate reads RED 11/13 on the NAS after a rebuild from its source (a sentinel-loop fix in its .debug_line section match, unrelated to the two failing teeth): `neg-control-baseline-LACKS-statement-lines-6-and-10` and `new-row-count-strictly-greater` both FAIL because the BLESSED compiler now emits the statement-granularity .loc rows the gate's neg-control assumed it lacked -- OLD(blessed) L5=1 L6=2 L9=1 L10=2 total=6 equals NEW(stmt) total=6, s_bytes 31830 both. The differential oracle collapsed the day statement granularity was promoted into the toolchain; the gate is now measuring the toolchain against itself. Remedy for the lang lane: turn the neg-control into a pinned pre-statement compiler fixture (or drop the differential and assert the statement rows directly, which teeth 12-13 already do at L6=1 L10=1 from real addresses). Until then this RED is a stale oracle, not a regression.
2026-09-03	LN	land	nx_dwline_stmt_gate oracle RE-PINNED and served: the two collapsed differential teeth became `blessed-compiler-CARRIES-statement-lines-6-and-10-the-feature-is-promoted` and `new-row-count-equals-the-blessed-count-both-statement-granular` (with a positive-count neg-control so an empty agreement cannot pass); rebuilt on the NAS 96280e8c, promoted, /api/gate_run 14 of 14 GREEN. The gate now pins that the toolchain KEEPS statement granularity instead of demanding it add what it already has.
2026-09-03	LN30	measure	Debt 1788324631 (nx_browser ships UNGUARDED, sev 7) root-caused by crossing two compiler generations against two browser closures on the laptop: OLD compiler x Sep-1 closure = 0 crash-guard labels; OLD compiler x current closure = 1; NEW (LN30) compiler x Sep-1 closure = REFUSED at nx_media_deepcrawl.nx:111 with the dangling-else voice plus the desync guard `func inside a function body`. An instrumented lexer consumed every byte of the Sep-1 closure (pos==srcn==3078315, 473910 tokens, no skip-to-EOF), so the lexer is exonerated.
2026-09-03	LN30	lesson	A FUNCTION THAT OPENS FIVE IFS AND CLOSES FOUR IS ACCEPTED BY A PARSER WHOSE `else` ABSORBS THE MISSING BRACE -- AND THE PREPASS, WHICH COUNTS BRACES, THEN SWALLOWS EVERY FUNCTION AFTER IT IN THE CLOSURE. The crash guard is appended LAST, so it was the first casualty: find_function NULL at main entry, DCE drops the uncalled guard, the Rule-of-2 surface ships with no fault handler. The prior row blamed scale and a slot clobber; the discriminating control was the closure, not the compiler. LN30 refuses the shape at the source; the loud main-entry warning stays as defence in depth.
2026-09-03	LN30	land	nx_media_deepcrawl.nx fifth brace landed on the NAS (11279 B, was 10999, both trees dac0826c); LN30+LN31 compiler rebuilt on the NAS from 6f632e7a/089e9c8c = 4d8e7a40 (923280 B, supersedes the LN30-only 3697bb30 staging), nx_cc_equiv_gate 10/10 + selfhost GREEN, /api/promote_toolchain canary GREEN -> buildroot/_offc/nx_cc_sovereign.elf is now 4d8e7a40 (5th canaried promote; .prev = e3d31613); serving-root nx_compile_x86.elf aligned to 4d8e7a40 by /api/promote (two artifact roots, two promotes).
2026-09-03	LN30	queue	nx_browser rebuilt on the NAS against the fixed closure = 51f7b258 (2,458,208 B against a served 1,439,825 B: the swallowed tail was a megabyte of code, not just the guard), promote through nx_contentdiff so the served browser carries nx_crash_guard.
2026-09-03	LN30	land	nx_browser PROMOTED on the fixed closure: 51f7b258 (2,458,208 B; served was 1,439,825 B), nx_contentdiff GREEN lost_from_live=0 over 809 runs, _offc twin refreshed -- the served browser carries nx_crash_guard. Debt 1788324631 EATEN with the mechanism on its NOTE. (Appended through the new nx_fs_write append verb, EC27.)
2026-09-03	LN33	measure	FILED FROM THE BEACH 2026-09-03: /world/beach answers 200 with Cross-Origin-Opener-Policy same-origin, Cross-Origin-Embedder-Policy require-corp and worker-src self blob (nx_host_router emits them on every response), the served page constructs zero Workers and zero SharedArrayBuffers, and the toolchain is the first byte that is missing: nx_shelltool grep atomic.rmw over buildroot/runtime nx returned matches=0 files=23506 coverage_complete=1 corpus_complete=1. The isolation is paid; this rung is what spends it.
2026-09-03	LN33	land	LANDED ON THE LAPTOP TREE AND PROVEN 2026-09-03 (both trees owed the same bytes; NAS landing follows in this leg): nx_atomic.nx (the intrinsic family as single-thread reference bodies, 32- and 64-bit load store add sub xchg cas, wait32, notify, fence); nx_wasm.nx and nx_wasm_scalararm.nx intercept the call sites (the F618 pattern) and emit `(import env memory (memory MIN MAX shared))` plus `(export memory (memory 0))` when the module declares nx_wasm_shared_req and nx_wasm_pages_max, refusing a shared request without a maximum BY NAME; nx_compile_wat gains --nothreads (the unshared twin from one source); nx_wat_compiler learns the 0xFE family (15 mnemonics, natural-alignment memarg), memory imports, limits flags 1 and 3, and refuses a shared memory without a maximum; nx_wasm_vm executes the family with single-thread semantics and supplies an imported memory. NEUTRALITY PROVEN against a control build from the pristine emitter: fx_plain and nx_wasm_pong WAT byte-identical (371951 B). nx_wasm_threads_gate (26 teeth over forked subjects plus the in-process VM twin, two named neg-controls, the --nothreads scale-down proven to run) written and built.
2026-09-03	LN33	measure	THE BROWSER HALF OF THE DONE-RULE, MEASURED ON THE WIRE 2026-09-03 (nishi-ops/ac_cdp.py with the new AC_CDP_SERVE cross-origin-isolation server, headless Edge, real 20 s): crossOriginIsolated=true SharedArrayBuffer=true; two Workers over ONE shared WebAssembly.Memory each ran tick(64, 2000000) through i32.atomic.rmw.add -- final counter 4000000, exactly 2 x 2000000, zero lost; the plain-store twin tick_racy over the same shape read 2935692 (1064308 updates lost) -- the neg-control fired; wait32 in a Worker answered 1 (not-equal) and notify 0; the cmpxchg, xchg, sub and 64-bit probes read 7009, 40003002 and 10000000008, the same values the VM twin computes. The fixture bytes were 3246 B of wasm from a 1435 B NishiLang source.
2026-09-03	LN33	lesson	a NishiLang static must be ZERO-initialised on both lanes (nxasm refuses G3_NONZERO_INIT_STATIC), so a driver-settable emitter flag takes the OFF polarity; and a static declared between functions is not seen by the driver that imports the lib -- declare it at the module head. The gate's browser half cannot live in a NAS gate (no browser there), so it lives on the CDP wire and the gate says so in its own note rather than pretending.
2026-09-03	LN33	land	LIVE ON THE NAS 2026-09-03: sources landed under content compare-and-swap and hash-identical on both trees (nx_atomic.nx 5343c589, nx_wasm.nx ef63bff2, nx_wasm_scalararm.nx d6aee0d8, nx_compile_wat.nx 80808bb0, _hdl_build/nx_wat_compiler.nx 55d1f551, nx_wasm_vm.nx c7972b4d, nx_wasm_threads_gate.nx 6106a334); NAS builds admitted (src_path verified, src_stable=1) and PROMOTED with expect_sha256: nx_wat_compiler 74000 B fbfa0156 (nx_contentdiff GREEN lost_from_live=0, nx_behaveprobe on the real craft-world WAT IDENTICAL STRONG; the prior 58919 B stage was banked as .prev, not overwritten) and nx_compile_wat 713960 B 03ccb597 (nx_contentdiff RED on exactly three runs, all the pre-LN31 wording of the module-level parser diagnostic that a sibling lane re-voiced on 2026-09-02, so promoted with allow_capability_loss=yes and the three named here; nx_behaveprobe DIFFERS at offset 0 because the live driver printed per-function progress names to stdout ahead of the WAT while the rebuilt one routes them to stderr -- the WAT body is the same shape, and a stdout consumer now gets clean WAT). nx_wasm_threads_gate 107792 B 9d666f1f PROMOTED, REGISTERED, HAND-ADDED to knowledge/gateroster.conf and declared on knowledge/compare/lang.gates; run through nx_job_run against the SERVED binaries: 31/31 GREEN. The rung symbol on this board and on lang.matrix was corrected from the contract name wasm_shared_memory to the function that exists, wat_mem_shared, so the ranker can read the rung as landed. CORRECTION to the earlier land row: the gate has 31 teeth, not 26 -- a count recited in prose drifted within the hour, which is the reason counts belong in the verdict line and not in a note.
2026-09-03	LN33	retract	the first cut lowered a NAME-INTERCEPT on a new nx_atomic.nx lib beside the incumbent __atomic_* builtins / nx_atom.nx / OP_ATOMIC_* family (x86 already lowers those to LOCK) -- a duplicate ruler; retired reversibly to knowledge/retired/buildroot_runtime_nx_atomic.nx-1788443992 and the emitters now lower the IR OPS (wat_emit_atomic_op) plus the futex __syscall(98) to memory.atomic.wait32/notify; the discriminating experiment was nx_capsearch atomic naming the incumbent
2026-09-03	LN33	measure	gate 32/32 GREEN laptop against the rebuilt driver; bite: faa->sub RED 27/32, shared ignored RED 28/32, futex left no-op RED 29/32, restore hash-identical; browser (Edge headless, AC_CDP_SERVE COI): 2 Workers x 2000000 -> atomic 4000000 EXACT, racy 2277488, probe_futex 10, probe_cas 1009, probe_big 10000000003 on the 891-byte module
2026-09-03	LN33	land	nx_wasm.nx v2 + nx_wasm_scalararm.nx v2 + nx_wasm_threads_gate.nx v2 CAS-landed both trees; nx_compile_wat PROMOTED abdef773 712744 B (behaveprobe IDENTICAL STRONG on nx_wasm_pong; contentdiff lost=24 occurrences all the retired nx_atomic_* names) + _offc twin refreshed; nx_wasm_threads_gate PROMOTED 06928c21 107352 B + _offc twin (lost=56 all the old 32-bit fixture text); the promoted gate ran 32/32 GREEN on the NAS against the served binaries; unshared output byte-identical to the pre-LN33 control on pong
2026-09-03	LN34	land	nx_riscv.nx: rv_home_t6 + OP_ATOMIC_LOAD/STORE/FAA/CAS/FENCE lowered to fence rw,rw+ld+fence r,rw / fence rw,w+sd / amoadd.d.aqrl / lr.d.aqrl-sc.d.aqrl loop (labels .L<fn>_cas<id>, a7 as the 4th scratch) / fence rw,rw; nx_rv64_asm.nx: +12 RV64A mnemonics (.d/.w, bare and .aqrl), fence with iorw sets, slt family, bnez/beqz, .L labels admitted (ra_is_directive); _hdl_build/nx_rv64_atomic_gate 26/26 GREEN: assembler vs field-layout oracle, rv64im_min_sim executes the atomics, backend lowers every op, END-TO-END the backend's emitted tick(cell,1000) runs on the sim in 22053 steps and returns 1000 with cell=1000, probe_cas returns 1009; bite: faa->amoswap RED 24/26, cas bne->beq RED 25/26, store fence dropped RED 25/26, lr without aqrl RED 25/26, .L labels dropped RED 23/26, restores hash-identical; all three sources CAS-landed on the NAS (24208 / 110424 / 19764 B)
2026-09-03	LN34	queue	nx_riscv.nx is in the compiler closure: the NAS toolchain must be rebuilt + canaried (/api/promote_toolchain after nx_cc_equiv_gate 10/10 + self-host) before the rv64 lane serves it; NAS build of nx_rv64_atomic_gate launched (job 1788445673), then register + roster + lang.gates row
2026-09-03	LN34	lesson	A MUTANT THAT DID NOT APPLY READS AS A SURVIVOR: two backend mutants first survived 26/26 because the sed never matched a backslash-n inside a string literal -- assert mutated_lines>0 before every mutant build or the harness proves nothing (the NOT-REACHED class of nx_gate_bite, reached by hand)
2026-09-03	LN34	measure	rv64 had NO lowering for OP_ATOMIC_* (nx_riscv.nx printed # unhandled op; only OP_FENCE existed) and the sovereign text assembler nx_rv64_asm had no amo/lr/sc/fence, no slt/sltu/slti/sltiu/sra/srai/xori, no bnez/beqz, and DROPPED every .L label as a directive -- the backend's own loop could not be assembled; x86 lowering pre-existed (x86ctx_emit_atomic), so LN34's real gap was rv64 + the assembler
2026-09-03	LN34	retract	the queue row above named a TOOLCHAIN CANARY as the next door; measured by nx_catalog: nx_cc (the served x86 compiler) does not import nx_riscv.nx at all, and the rv64 driver nx_nxc is BUILT-UNPROMOTED on the NAS (605385 B fossil, never served), as is nx_main -- so the lowering reaches production through the organs that IMPORT nx_riscv.nx on their next build (laptop census of buildroot/runtime + _hdl_build: nx_main, nx_nxc and six nx_smoke_nxc_pipeline* sources), not through /api/promote_toolchain; nx_rv64_atomic_gate PROMOTED e7866f8e 871136 B, REGISTERED, _offc twin refreshed, RAN 26/26 GREEN on the NAS, declared on lang.gates with that receipt; remaining door = promote nx_nxc so an rv64 build is a served organ
2026-09-03	LN37	land	f64-compare op0-in-rax fix landed on the NAS toolchain source by CAS and promoted via canary (6cf44630, GREEN, prev a5702510 banked). Whole-corpus census 3267 programs zero G4 traps. Found by the CM4 quadrature gate.
2026-09-03	LN38	land	NaN unordered-compare guard landed in the same toolchain promote; nx_f64_gate grew two LN38 teeth, 27 of 27 GREEN with the fix and 26 of 27 RED against the banked pre-fix compiler (fixture exit 103).
2026-09-03	LN38	lesson	The ordering-key transform is a TOTAL order on the bit pattern, and a total order has no unordered element; IEEE-754 requires NaN to be unordered, so any comparator built on a total-order key is wrong on NaN by construction. The assembler had no ucomisd or jp, so the guard is integer arithmetic on the exponent and mantissa fields.
2026-09-03	LN36	queue	Three literal gaps found while writing the CM4 gate, each with a workaround so nothing is blocked: exponent form (LN36), f64 const-expr (LN39), large-fraction overflow (LN40). Recipes are in each rung note.
2026-09-03	LN36	land	Decimal exponent literals (1e9, 2.5E-3, 6.02e+23): the lexer is now one digit machine (value = m x 10^e10 with m the first 18 significant digits and a sticky bit for dropped digits) and fp64_from_dec packs it -- exact rational core when m below 2^53 and the power of ten fits an i64, a 128-bit wide path (umulhi chunks of 5^25) otherwise, correctly rounded down to 1e-43 and within 1 ulp beyond. Fixture nx_fx_f64_lit: 13 checks, every literal bit-equal to ONE IEEE operation on exact operands. Laptop toolchain 2aaa21ad blessed (equiv + self-host green); NAS sources landed by CAS hunks (tokenizer, quant, parse, compile_x86); NAS build b940c1fe staged; canary promote retrying under an admission storm.
2026-09-03	LN40	land	The compiler no longer hangs: a 20-digit fraction (sticky) and a 22-digit whole part (wide path) both pack; an integer literal that needs a 65th bit is REFUSED by name with the teaching voice (kind 3). Census over 13790 programs under the new compiler: 773 refusals vs 777 before, and the ONLY new ones are 4 -- the planted fixture and THREE real estate gates whose limb constants were always wrong (see queue row). nx_f64_gate LAYER 6 is 33/33 GREEN; against the pre-fix toolchain the literal fixture TIMES OUT (the hang, witnessed under timeout 20), the const fixture is refused and the overflow literal wrongly compiles.
2026-09-03	LN40	lesson	The first cut refused every decimal above i64 max and the census jumped by 286 refusals: the estate writes u64 patterns in decimal (FNV offset bases, all-ones masks, hash multipliers), so the bound is 2^64-1 and a decimal in [2^63, 2^64) is the unsigned pattern. Every fixture was green under the strict bound; only the whole-corpus census could see the class. A census whose compiler binary is rebuilt mid-run is contaminated -- run it on a frozen copy.
2026-09-03	LN39	land	const NAME: f64 = EXPR folds at compile time with the software IEEE-754 routines the f64 gate proves bit-for-bit against the hardware ops (+ - * / unary minus parens; int literals and int consts convert exactly; f64 consts chain). Fixture nx_fx_f64_const: 7 checks equal to run-time hardware bits. kind 2 in the module-const table; use sites materialise a TY_F64 constant.
2026-09-03	LN28	land	The Q4_K super-block dot intrinsic (OP_Q4KSBDOT const, ir_emit_q4ksbdot, x86ctx_emit_q4ksbdot and its dispatch) was a LAPTOP-ONLY fossil: the NAS toolchain sources lacked it while lang.plan called it landed. Landed on the NAS by CAS hunks (nx_types, nx_ir, nx_x86_64_ctx); the laptop and NAS toolchain sources now differ only in whitespace. Proof to run on the NAS once the canary promote lands: nx_q4k_simd2_gate (SOURCE-ONLY there today).
2026-09-03	LN40	queue	Three authored bigfloat gates carry a 20-digit limb constant above 2^64 and now refuse to compile: _bf_sinhcosh_gate_authored.nx:60 st[0] = 31622776601683793320, _bf_tan_gate_authored.nx:61 st[0] = 26457513110645905905, _f64_sinhcosh_gate_authored.nx:69 st[0] = 27182818284590452353. They compiled before only because the literal WRAPPED, so every result they graded used a wrong constant. The bigfloat lane owns the split into limbs; the refusal stays.
2026-09-03	LN41	measure	A DUAL-TARGET MODULE CANNOT CARRY THE LN33 MEMORY DECLARATION AT ALL, AND THE PROBE THAT PROVED IT COST ONE BUILD: nx_wasm_craft compiles BOTH natively (its gates import it) and to wasm, and adding static nx_wasm_pages_req/pages_max/shared_req made the native lane emit G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES five times and refuse. ROOT CAUSE READ FROM THE SOURCE, not guessed: nx_x86_64_ctx.nx x86ctx_emit_module_globals refuses a WRITABLE NON-ZERO static because .rodata is read-only on the GNU as/ld lane and 'nxasm IGNORES .data sections wholesale (nxasm_x86.nx:810)', leaving .lcomm (zero-fill only) as the sole both-lanes-writable form. The workaround is already documented in THREE other organs (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib), so this is a recurring gap with a measured cost, not a one-off
2026-09-03	LN41	lesson	A STAGED ARTIFACT IS INERT BY CONSTRUCTION, SO nx_behaveprobe ON A STAGE SLOT REPORTS other_rc=127 other_bytes=0 DIFFERS FOR A PERFECTLY GOOD BINARY. content_put writes the .new without an execute bit and /api/promote is what sets the mode, so the probe exec'd a non-executable file. Read as a verdict it says 'the candidate is broken'; read correctly it says 'you probed a file nothing can run'. The promoted binary then ran 32/32 and 37/37 on the NAS. ⇒ for a laptop-shipped artifact, promote (which sets the mode) and verify by RUNNING it, or the probe indicts the wrong subject
2026-09-03	LN36	land	THE MEMORY DECLARATION IS NOW A BUILD-LANE DOOR, WHICH IS THE CORRECT DESIGN AND NOT A WORKAROUND: the standing order is that a target's limit is a declared door on a ladder, never a constant in the source, and ONE source must build at a sensor's memory and at a supercomputer's -- a static bakes one answer in. nx_compile_wat gained --shared <pages_req> <pages_max> (zero-init statics wat_shared_req/wat_pages_req_flag/wat_pages_max_flag, the only initializer the native lane accepts; zero means not-given so the LN33 module-global path is untouched). PROVEN: pong WITHOUT the flag is BYTE-IDENTICAL to the banked control, --shared 3 8 on a module with NO statics emits (import env memory (memory 3 8 shared)) plus the re-export, --shared 3 8 --nothreads emits the UNSHARED twin AT THE SAME DECLARED SIZE, and --shared 0 8 / --shared 9 4 are refused by name. nx_wasm_threads_gate 32/32 -> 37/37 GREEN on the NAS against the promoted binaries; nx_compile_wat promoted 6c6f5f4d 643364 B, gate promoted 1895335d 98850 B, both _offc twins refreshed
2026-09-03	LN41	lesson	A HAND-COUNTED LENGTH BESIDE A STRING LITERAL TRUNCATED THREE REFUSALS AND THE GATE CAUGHT IT: I passed watd_log(msg, 58/55/69) for messages that are 60/57/71 bytes, so every --shared refusal printed a CUT string. The refusals fired correctly and the teeth searching for their text failed -- the defect was invisible in behaviour and visible only in the assertion. Fixed by DERIVING the length (watd_logs walks to NUL). This is the estate's own banked law and I broke it anyway; the tooth is what made it cost minutes instead of a session
2026-09-03	LN41	lesson	RUNG IDS COLLIDE ACROSS CONCURRENT LANES ON A SHARED BOARD AND NOTHING CHECKS: I appended a rung as LN37 and four log rows as LN36, and BOTH ids were already taken by another lane's rungs landed the same day (LN36 decimal exponent literals, LN37 the f64 ordered-compare fix). The board accepted the duplicates silently -- a plan with two rungs sharing an id is the same coin-flip-wearing-a-schema defect organ_kind.conf was caught with, and the ranker reads whichever it matches first. Renumbered mine to LN41/LN42 after grepping for free ids. ⇒ GREP THE BOARD FOR THE ID BEFORE APPENDING A RUNG, and the durable fix is a uniqueness tooth in the compare referee rather than a habit.
2026-09-03	LR7	measure	nx_bck_elide_gate against the LIVE promoted nx_compile_x86.elf (923280 B) is 13/13 GREEN, elision proven dominance-gated, both OOB legs still trapping 71. Gate-published timings: h2h_A2_divfree_checked no_elision 41266 us vs with_elision 20711 us = 1.99x on the div-free checked accumulate loop.
2026-09-03	LR7	retract	WITHDRAWN: the 08-31 claim that the live toolchain provably lacks LN7 elision and that the single outstanding action is a toolchain promote of nx_compile_x86. That promote had already landed; live is 923280 B, not the 737605 B the claim was measured against. Discriminating experiment: one gate, two compilers, run SEQUENTIALLY -- run concurrently they share the constant fixture dir /tmp/nx_bck_elide_gate and clobber each other into a false SKIP.
2026-09-03	LR7	land	lang.matrix field 2 repointed runtime/nx_boundscheck.nx -> runtime/nx_bck_elide.nx (79958->79956) and the note carries the re-derivation (79956->81451). Both writes CAS-guarded, byte delta predicted and asserted.
2026-09-03	LN18	measure	nx_chkarith_jo_gate is 15/15 GREEN against the LIVE promoted compiler AND against the staged nx_compile_x86.sov.elf.new, with the anti-fallback neg-control BITE-PROVEN in both runs, so LN18 is already in the shipped compiler and the staged binary adds no capability over live.
2026-09-03	LN18	measure	DONE-RULE NOT YET MET AND SAID PLAINLY: this rung's bar is the daily mode within 1.3x of the default build on the accumulate loop; the receipt in the matrix note reads daily 10567 us and checked 10688 us against 7105 us default = 1.49x. LN18 is SHIPPED but has not cleared its own bar.
2026-09-03	LR7	queue	OPEN REGRESSION, not hidden: h2h_A_modulo_checked no_elision 102547 us vs with_elision 112529 us -- elision COSTS about 9.7 percent on the modulo shape. The gate publishes that ratio and gates nothing, so no instrument would have caught it.
2026-09-03	LR7	lesson	A matrix note that hand-asserts what the SHIPPED BINARY can do has nothing re-measuring it, so it rots -- and it rots in the PESSIMISTIC direction, which nobody audits. Two rungs on this board (LR7, LN18) were understated on the same day and each cost a full re-derivation. Symbol-presence is the WRONG instrument: LR7's symbol was in source the whole time while the note said the compiler lacked it. Only a GATE VERDICT AGAINST THE LIVE ARTIFACT settles a capability claim.
2026-09-03	LN28	land	The Q4_K super-block dot intrinsic is PROVEN ON THE NAS at last: nx_q4k_simd2_gate promoted and run there, 9 of 9 GREEN, simd_ns 54732469 vs simd2_ns 8953465 = 6.11x over 2000 rows of 14 super-blocks. It had been a laptop-only fossil while this board said LANDED -- the NAS toolchain carried none of OP_Q4KSBDOT, ir_emit_q4ksbdot or x86ctx_emit_q4ksbdot until today.
2026-09-03	LN36	land	Toolchain b940c1fe canary GREEN on the NAS (LN28 + LN36 + LN39 + LN40 + the u64 literal bound), prev 6cf44630 banked. nx_f64_gate rebuilt, promoted and run THERE: 33 of 33 GREEN, covering both refusal neg-controls (each asserting the diagnostic NAMED the defect, read from the compiler cclog) and both positive controls (largest i64 literal, and a u64-range decimal keeping its bit pattern).
2026-09-03	LN36	measure	nx_langcensus over the whole tree with the promoted compiler: 13718 top-level programs, ok 10195 err 3523 hang 0 harness 0, partition RECONCILES, 200 distinct refusal reasons. That err figure was then REFUTED by its own author -- see the lesson row.
2026-09-03	LN36	lesson	A NEW INSTRUMENT IS GUILTY UNTIL PROVEN, AND ITS FIRST RUN INDICTED ITSELF. nx_langcensus read 3523 refusals where an independent shell census read 773, and 2866 of them carried an EMPTY reason -- almost exactly the gap. Cause: tr_run_capture_to merges stdout and stderr, and the compiler writes the whole assembly to stdout (its own is 4178018 bytes), so a 256 KiB capture overflowed and every large program came back non-zero with no diagnostic. Fixed by sizing the capture from the largest measured assembly (16 MiB, mmapped once) AND by making a filled capture ABSTAIN as HARNESS rather than convict as a refusal, plus naming the no-marker class instead of letting it group as one blank cause. Re-run: error rate 25.7 percent to 6.4 percent, matching the independent instrument. TWO INSTRUMENTS THAT DISAGREE LOCATE A DEFECT NEITHER COULD FIND ALONE, AND THE CONFIDENT ONE WAS THE BROKEN ONE.
2026-09-03	LN36	queue	The census baseline lives at knowledge/status/langcensus.baseline with the compiler banked beside it at knowledge/status/ccbank/cc_live.elf. NEVER keep either in /tmp: the tmpstorereap beat destroyed the rows file at 13718 of 13790 rows and then the staged compiler, three times in one session. Next compiler change: run nx_langcensus <new-cc> <out> 60000 knowledge/status/langcensus.baseline and read the DELTA lines -- each names a program whose class moved.
2026-09-03	LN42	land	THE GAP IS CLOSED IN SOURCE AND PROVEN ON THE LAPTOP FARM. nxasm_x86 axc_apply_section now maps a bare .data AND .section .data to section 1 (the DATA TAIL) instead of the ignore bucket -- the one fact that made a writable non-zero static unemittable on either lane. nx_x86_64_ctx gained x86ctx_global_nonzero and emits every writable non-zero global as .data + .Lg<id>: + a .byte list in a block placed BEFORE the rodata stream (cursor 0 is aligned) with each entry padded to the next 8-boundary (always a full 8 when already aligned, deliberately: the content loop emits a trailing comma after every byte, so a zero pad would leave a bare .byte -- the empty-literal miscompile this file already carries a witness for). The G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES refusal is retired; only all-zero writable globals still take .lcomm and that path is byte-for-byte unchanged.
2026-09-03	LN42	lesson	A SOURCE HUNK'S BACKSLASH-n ESCAPES ARRIVE ON THE NAS AS REAL NEWLINES, SO A LANDED SOURCE IS NOT BYTE-EQUAL TO THE ONE YOU PROVED. Measured here: the landed emitter reads 210068 B against the proven local 209993, and reading the region back shows out_str(o, " .data\n") rendered with an actual line break inside the string literal. This dialect PERMITS a literal newline in a string so the two are semantically identical and it compiles the same -- but every local-vs-NAS hash comparison across that transport will differ even when the change is right, and any byte-identical claim made across it is unsound. ⇒ compare landed source by READING THE REGION, never by hashing it against the local copy, and treat a size delta after a hunk write as expected rather than as evidence of a bad write.
2026-09-03	LN42	measure	PROVEN THREE WAYS with the freshly built pair, none of it asserted: (1) the new compiler emits ZERO refusal lines and exactly one .data directive for a fixture carrying static answer: i64 = 42 and static tag: i64 = 1234567, the entry reading .Lg10: .byte 42, 0,0,0,0,0,0,0 then eight pad bytes; (2) the new assembler accepts it (rc=0, 7320-byte ELF) and the fixture RUNS returning 0 -- which it can only do if the initializer survived (a0==42), the slot is WRITABLE (a1==43 after a write) and the second static is intact (1234567), each with its own distinct non-zero exit code; (3) NEUTRALITY: nx_wasm_pong assembles BYTE-IDENTICAL between the old promoted compiler and the new one, so the .data block is skipped entirely when no such global exists. The standing witness is runtime/nx_ln42_probe.nx, landed beside nx_empty_lit_probe.
2026-09-03	LN42	queue	THE TOOLCHAIN PROMOTE IS DELIBERATELY NOT DONE. Both sources are landed on the NAS and read back correct, and the change is proven on the laptop farm, but a compiler goes live only through /api/promote_toolchain with its canary, and the NAS build to feed that canary is storm-refused and QUEUED (nx_build_admit, I/O storm). Remaining, in order: let the queued nx_compile_x86 build fire, build nxasm_x86_main, run the fixture against the NAS-built pair, then promote_toolchain (canaried, .prev-banked, auto-rollback) and re-promote the serving root -- two artifact roots means two promotes. ⚠nx_cc_equiv_gate reads RED (rows=10 passed=0) but it is the estate's documented MUTATION oracle that is vacuous without a challenger; the neutrality evidence that counts is the direct old-vs-new asm comparison above, and a whole-corpus sweep of it was started and did not finish.
2026-09-03	LN42	measure	NEUTRALITY, AT THE STRENGTH IT ACTUALLY EARNS: a whole-corpus sweep compiling every buildroot/runtime source with the OLD promoted compiler and the NEW one and comparing bytes reached 4932 of 12057 files before hanging on nx_fx_f64_elide.nx -- 4714 BYTE-IDENTICAL, 127 unbuildable by both (SKIP), 91 flagged DIFF. EVERY DIFF SAMPLED (nx_adhd_gate, nx_bills_gate, nx_codegrep, nx_accommodate_gate, nx_access_research_fetch -- 5 of 91) ADJUDICATES IDENTICAL WHEN RE-RUN SERIALLY: each produces ZERO bytes from BOTH compilers, i.e. it does not compile standalone and should have been a SKIP. ⇒ the DIFF column measures the SWEEP'S OWN CONTENTION, not the compiler: 24000 invocations of two ~900 KB compilers under load, through SHARED temp files, in the documented nondeterministic-failure class. The honest claim is therefore 4714 modules proven byte-identical and no adjudicated semantic difference -- NOT zero differences, and NOT whole-corpus coverage.
2026-09-03	LN42	lesson	A SWEEP THAT SHARES TEMP FILES MEASURES ITS OWN CONTENTION AND PUBLISHES IT AS A FINDING ABOUT THE SUBJECT. My neutrality sweep wrote every comparison through one o.s and one n.s; a stray reader (my own concurrent spot-check) and load-induced nondeterministic compile failures both land as DIFF rows that look exactly like real semantic differences. Worse, my first attempt to ADJUDICATE those rows ran WHILE THE SWEEP WAS STILL COMPILING, so the adjudication was contaminated by the same cause -- I varied two dimensions at once and briefly believed a correct change had regressed 57 organs. ⇒ give every iteration UNIQUE temp paths, re-adjudicate every non-SAME row SERIALLY with nothing else running before publishing it, and remember the earlier law's twin: the first sweep was killed and produced ZERO output because it buffered to stdout, which is why this one appends durably per row and could be read at all.
2026-09-03	LN42	lesson	THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- one says are these semantically the same text, the other says are these the same bytes -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears, run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong.
2026-09-03	LN42	retract	I PUBLISHED A FALSE LAW LAST PASS AND THIS RETRACTS IT: I claimed a source hunk's backslash-n escapes arrive on the NAS as REAL NEWLINES, so a landed source could never be byte-equal to the proven local one. REFUTED by the discriminating experiment I should have run before publishing -- a controlled probe carrying a bare backslash, a backslash-quote and a backslash-u through the SAME nx_fs_write path landed 36 bytes for 36 bytes with every backslash intact. The transport is FAITHFUL; nxmcp builds its body with json.dumps and ensure_ascii=False precisely so it stays that way. THE REAL CAUSE of the 75-byte gap was my own bookkeeping: my extraction script read the files with Python's DEFAULT universal-newline translation (CRLF collapsed to LF) and so reported reconstruct==local, while a raw newline='' read shows old+hunks = 210068 against a local 209993 -- a line-ending difference between my working copy and my reconstruction, NOT a corruption of what landed. Both changed regions on the NAS were read back directly and are correct. ⇒ A FALSE LAW PROPAGATES FASTER THAN A DEFECT, and the cost of this one would have been every future seat distrusting a write path that works.
2026-09-03	LN42	lesson	THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- is this the same TEXT versus is this the same BYTES -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong.
2026-09-03	LN36	measure	nx_langcensus found the single largest refusal class in the estate: 314 of 13721 top-level programs refused with "a control byte (decimal 14) sits in the source here" -- larger than the next nineteen classes combined, and invisible to every gate because a source that cannot compile runs no test. Each carried ONE contiguous run of exactly 119 bytes of 0x0E sitting inside an integer-print helper, between the digit loop and its return.
2026-09-03	LN36	land	nx_ctlbyte_repair BUILT, PROMOTED and REGISTERED: a sovereign NishiLang organ that walks NAMED roots, locates the corrupt run, and classifies it by the contract the surrounding code pins -- INSERT-TAIL when the reversal and write were destroyed, DROP-RUN when only trailing cleanup was, UNKNOWN-SHAPE when neither, which it refuses to touch. Dry by default; --apply re-reads every file afterwards to prove the byte is gone. Repaired 314 of 314 on the laptop tree, all verified, tree now CLEAN.
2026-09-03	LN36	measure	THE REPAIR IS PROVEN BY THE INSTRUMENT THAT FOUND IT: a second census against the pre-repair baseline reads programs 13727 ok 13300 err 427 hang 0 harness 0 RECONCILES, delta new_err=0 new_hang=0 FIXED=320. Refusals fell 747 to 427 with nothing broken, and 13 of the recovered sources are on the gate roster -- their binaries had been running while their sources could no longer rebuild them.
2026-09-03	LN36	retract	I published that the corruption was present on BOTH trees. WRONG, and the discriminating measurement is the organ itself: reading actual bytes across 19272 NAS sources it reports affected=0 CLEAN. My both-trees claim came from grepping an od dump where the OFFSET COLUMN matched the octal I was searching for. A grep over a formatted hex dump is not a byte test.
2026-09-03	LN36	lesson	The laptop copies were AHEAD as well as corrupt: the NAS original prints "RED" where the laptop prints "verdict=RED", the token every last-line verdict reader anchors on. Adopting the intact NAS copies wholesale would have compiled the tree and DELETED that work. The reconstruction was behaviourally equivalent instead (one buffered write rather than k single-byte writes) and preserved the newer content -- proven by building and running the repaired gates, 11 of 11 and 17 of 17 PASS with the helper printing those counts. ★A CORRUPT FILE IS NOT AUTOMATICALLY AN OLD FILE, AND THE INTACT TWIN IS NOT AUTOMATICALLY THE ONE TO KEEP.
2026-09-03	LN36	lesson	The organ FIRST shipped with its roots hard-coded as runtime/, and on the NAS (CWD = the serving root, 17 files) it reported files=17 verdict=CLEAN over a tree whose sources live in buildroot/runtime/. ★A SCANNER POINTED AT THE WRONG ROOT PRODUCES A CONFIDENT, COMPLETE-LOOKING FALSE NEGATIVE. Roots are now arguments, the organ PRINTS the ones it walked, and a zero-file walk exits UNPROVEN instead of CLEAN (bite-proven).
2026-09-03	LN41	measure	The census made this class visible and then measured the fix: 40 programs refused with "I do not know the name K_MAGIC_65536", a name that IS declared on nx_crash.nx line 2. Every one was a single unbalanced brace in the program itself. After LN41, 40 of 40 name their own opening brace with file, line and caret -- other=0. Positive control: a healthy program still compiles unchanged (nx_quadrature_gate, rc=0, 153801 bytes of assembly).
2026-09-03	LN41	lesson	★★★★★★A STRUCTURAL BREAK REPORTED AT THE PLACE IT SURFACES SENDS EVERY READER TO A FILE THAT IS NOT THE PROBLEM. The token stream knew exactly where the brace was opened the whole time; nothing had to be inferred, only said. The tell that it was structural and not a missing symbol was the diagnostic pointing its caret AT a const declaration while claiming the name had no definition, plus a following error quoting comment prose as code.
2026-09-03	LN41	lesson	This class was invisible to every gate for the same reason the 0x0E class was: ★A SOURCE THAT CANNOT COMPILE RUNS NO TEST, SO ITS SILENCE READS AS HEALTH. Two of the three largest defect classes in the estate were only findable by compiling the whole population, which is the argument for nx_langcensus existing at all.
2026-09-03	LN28	retract	I PUBLISHED "LN28 PROVEN ON THE NAS 9 of 9 GREEN 6.11x". That claim measured the WRONG SUBJECT and I am withdrawing it. nx_q4k_simd2_gate mentions __q4k_sb_dot exactly once, in a COMMENT on line 192; it never calls the intrinsic. Its 9 of 9 and its 6.11x are real but they measure the __q4k_unpack32s path against the scalar ruler, not the whole-super-block dot. The discriminating experiment: the NAS parser contained ZERO occurrences of __q4k_sb_dot, so a program calling it could not have compiled at all.
2026-09-03	LN28	land	The intrinsic was BUILT AND UNWIRED on BOTH trees: OP_Q4KSBDOT in nx_types, ir_emit_q4ksbdot in nx_ir and x86ctx_emit_q4ksbdot plus its dispatch in nx_x86_64_ctx all shipped, and NOTHING routed the NAME in nx_parse, so every program calling it refused with "unhandled __ intrinsic". 32 such programs, found only by the whole-population census once its marker list learned the older parse_die vocabulary. Parser mapping added (4 operands); nx_q4k_dot_simd2_lib.nx, which could never compile, now builds to 12770 bytes of assembly; 31 of the 32 compile (the 1 holdout fails on an unrelated undefined name). Toolchain ef74425bab01636f canary GREEN.
2026-09-03	LN28	lesson	★★★★★★AN INTRINSIC IS NOT SHIPPED UNTIL ITS NAME REACHES ITS EMITTER: the opcode, the IR builder and the codegen can ALL exist, be reviewed, be landed on both trees and still be unreachable from every program, because the one line that maps the spelling to the builder is missing. And the gate that was supposed to prove it passed throughout -- its subject was a sibling intrinsic. ★A GREEN GATE PROVES WHAT IT CALLS, NEVER WHAT ITS NAME SUGGESTS; READ THE CALL SITES BEFORE BELIEVING THE VERDICT.
2026-09-03	LN43	retract	WITHDRAWN BY ITS AUTHOR, SAME DAY IT WAS FILED. The modulo regression (3-10 percent, 3 rounds) was NOISE: those rounds ran on the NAS with a degraded write path where that arm's own run-to-run spread was 27 percent, so a consistent direction over three samples was inside the noise band. Quiet-host re-measure, 15 interleaved rounds: div-free 8275 vs 5210 us (1.59x WIN), modulo 45807 vs 44851 us with ranges OVERLAPPING (neutral). No cost model is needed and no shape must be declined.
2026-09-03	LN44	measure	THE ESTATE COMPILES EVERY ORGAN IN DEFAULT MODE -- no build lane passes --mode. Default has --bckelide OFF, so the estate ships its slowest mode by omission while f1 is proven sound (13/13) and measures 1.59x locally and 7105 vs 4189 us on the receipt. At 4189 us f1 BEATS rustc -O checked (4445) and ties Go (4163); the default we ship trails both by 1.7x.
2026-09-03	LN44	lesson	A CONSISTENT DIRECTION ACROSS THREE SAMPLES IS NOT A FINDING WHEN THE INSTRUMENT'S OWN SPREAD IS FOUR TIMES THE EFFECT. I published a 6 percent regression measured on a box whose spread was 27 percent. The discriminating move was not more rounds on the same host -- it was a QUIETER HOST with a minimal fixture, where the effect either survives or dissolves. It dissolved, and chasing it would have bought a cost model for a phenomenon that does not exist.
2026-09-03	LN44	queue	THE FIX IS A BUILD-LANE POLICY, NOT A COMPILER DEFAULT, AND THE REASON IS THE UNDO PATH: nx_compile_x86's default-OFF contract keeps default builds byte-identical, which every drift and contentdiff instrument depends on. Flipping it estate-wide re-baselines all of them at once, so the comparison surface needed to judge the change would be destroyed by the change. Stage it per-target through the build lane with nx_behaveprobe proving output identity first.
2026-09-03	LN44	measure	THE 1.696x ELISION WIN IS UNREACHABLE FROM THE BUILD QUEUE AND THE CAUSE IS A PATH, NOT THE PASS. nx_compile_x86.nx read its mode table from ONE bare CWD-relative literal knowledge/lang_modes.conf, declared at line 120 and read at exactly one site, line 143 (nx_shelltool grep NXCX_MODES_CONF over buildroot/runtime returns matches=2 coverage_complete=1 corpus_complete=1). That file exists ONLY at buildroot/knowledge/lang_modes.conf, 1907 B; knowledge/lang_modes.conf is ABSENT from the serving root. The build QUEUE starts in the serving root, so a --mode=f1 build issued from the queue could never resolve the conf and would REFUSE, while the identical command from buildroot succeeded. CORRECTION TO THE BRIEF THIS LANE WAS GIVEN: the refusal exit is 9 (NX_COMPILE_X86_BAD_MODE), NOT 111 -- the 111 is the dead length argument of nxcx_log, which LN27 had already made untrusted because the function recomputes the length itself.
2026-09-03	LN44	land	MODE-CONF RESOLUTION FIXED BY COMPOSING THE INCUMBENT RESOLVER RATHER THAN WRITING A SECOND ONE. nx_compile_x86.nx 39544 B sha 2237f186 to 42406 B sha 7a34a429 in six CAS edits, every one verified by predicted byte delta. It now calls ct_readall_2dir from nx_comparetree_lib with its OWN dirs (position 1 knowledge/ and position 2 buildroot/knowledge/), which sizes its buffer from the file so it cannot short-read, and writes which position answered on EVERY path INCLUDING the miss. Only the GENERIC 2dir primitive is used, never the /compare wrappers, so the compare-side order adjudication cannot reach the compiler. The winning root is ANNOUNCED on the success path too, on stderr never stdout, because the two knowledge trees are FORKED rather than copies and a silent pick between two lang_modes.conf files would expand a mode from the one nobody was looking at. COMPILE-PROVEN: the laptop copy was made byte-identical to the NAS (both sha 7a34a429, 42406 B) and nx_sov_build_run --build-only returned rc=0 with an 866180 B artifact.
2026-09-03	LN44	lesson	A REFUSAL GUARDED BY A FLAG NOBODY PASSES YET IS A LANDMINE RATHER THAN A BUG -- IT CANNOT FIRE UNTIL THE DAY SOMEONE ADOPTS THE FEATURE, WHICH IS THE DAY IT COSTS THE MOST. The acceptance bar is therefore structural and not empirical: nxcx_expand_mode is the only reader of the conf and has exactly ONE call site, guarded by if nxcx_is_mode_flag(marg) == 1, so a build passing no --mode= never opens the file and can never refuse; and position 1 is the incumbent literal byte for byte, so ct_readall_2dir returns the same bytes for every CWD that resolved before and consults position 2 only where the old code had ALREADY refused. A refusal can become a success and a success cannot become a refusal.
2026-09-03	LN44	queue	BUILD QUEUED, NOT LANDED, ON THE NAS. /api/build target=nx_compile_x86 was REFUSED by nx_build_admit and the build did NOT run; the enqueue returned queue_launch_rc=0 queued=1 row BQ-nx_compile_x86, so it fires on the first nx_orchestrate pass with headroom. THE REFUSAL DESTROYED THE _build FOSSIL -- nx_catalog read BUILT yes 957128 B before and BUILT NO after, the runner reporting no artifact at buildroot/_build/nx_compile_x86.sov.elf -- so every staleness comparison against that path is measuring an absence until the queued build lands. nx_compile_x86 is TOOLCHAIN and must move via /api/promote_toolchain with its canary, never a plain promote; this lane deliberately did NOT promote it.
2026-09-03	LN44	lesson	THE TASK-3 PREMISE THIS LANE WAS BRIEFED ON WAS ALREADY REFUTED ON THIS BOARD BEFORE I WROTE A LINE. I was told elision is a REGRESSION on modulo shapes (102547 to 112529 us, minus 9.73 percent) and that the missing piece is an LN43 profitability heuristic. The sibling row log 1788476600 LN43 retract, filed minutes earlier by its own author, WITHDRAWS exactly that: on a quiet host over 15 interleaved rounds the modulo arms OVERLAP (45807 against 44851 us) and the apparent effect sat inside a 27 percent instrument spread. So NO cost model is required, LN43 is retracted, and the live rung is LN44. My four rows above were filed under LN43 and were RE-KEYED to LN44 in one all-occurrences edit; that edit returned 503, had in fact LANDED, and only a CONTENT read could tell, because LN43 and LN44 are the same length so the byte size was identical either way. LINKAGE WORTH STATING: the mode-conf resolution fix is the PRECONDITION for LN44's own done-rule -- a build lane cannot declare --mode=f1 from the queue while --mode= REFUSES from the queue, which is what the bare CWD-relative conf path guaranteed. READ THE BOARD BEFORE ACTING ON A BRIEF: a briefing is a snapshot, and this one was stale on a board that moves by the minute.
2026-09-03	LN44	land	MECHANISM SHIPPED, WIRING NEXT. nx_buildmode_lib (7900 B) makes the compile mode DATA -- knowledge/build_modes.conf rows target
2026-09-03	LN44	measure	THE SAFETY PROPERTY IS THE LOAD-BEARING TOOTH AND IT HOLDS: with no conf present the reader returns absent_conf_flags=0 AND absent_conf_keylen=0, so adopting this lib cannot change one byte of one artifact, and every existing build-cache entry stays valid. There is no flag day. A row is what changes behaviour, and only for the target it names.
2026-09-03	LN44	lesson	THE CACHE KEY WAS THE TRAP AND IT WAS NEARLY MISSED. nx_sov_build_run caches artifacts under sha256(expanded closure ++ compilerSha ++ asmSha ++ g-or-n). A mode that changed emitted code WITHOUT entering that key would serve an artifact compiled under the OTHER mode and present it as a cache hit -- silently correct-looking and wrong. bm_key_token exists so the mode enters the key by construction, and the gate asserts two modes can never share one. Read what a cache keys on BEFORE adding an input to the thing it caches.
2026-09-03	LN44	queue	WIRING IS THREE SITES IN nx_sov_build_run, all named: the cache key at sbr_cache_key (line 429, where want_debug already contributes g-or-n), the compiler argv at line 1406 (where -g is already appended), and one import. The proof that gates the wiring is BYTE IDENTITY: with no conf present, a target built by the wired runner must hash identical to one built by the unwired runner. That is the experiment to run before it ships, and it is cheap.
2026-09-03	LN46	measure	Measured over the whole class in the census baseline: parse_die refusals carrying file and line went 0 to 24 (parse_die itself), then to 43 (the unhandled-intrinsic site), then to 46 with still_bare=0 (the forward-const site). Toolchain b89d609234304148 canary GREEN. Example: a bare "unknown identifier in const-expression" became nx_arena_smp_gate.nx:38 with the source line and a caret on NX_MAGIC_2000000000 -- which is itself the next defect, a hoisted const that was never declared.
2026-09-03	LN46	lesson	★★★★★A DIAGNOSTIC WITHOUT A LOCATION IS A SENTENCE, NOT A DIAGNOSTIC -- AND IT IS ALSO UNGROUPABLE, SO IT HIDES ITS OWN FREQUENCY FROM EVERY CENSUS THAT WOULD HAVE RANKED IT. These 90 refusals sat in one blank class called "no recognised diagnostic marker" precisely because there was nothing in them to key on. Fixing the voice made the class countable, and counting it surfaced the __q4k_sb_dot unwiring underneath.
2026-09-03	LN46	lesson	The unhandled-intrinsic refusal now distinguishes two absences that need OPPOSITE actions and used to share one word: an intrinsic whose emitter exists but whose NAME was never routed is BUILT AND UNWIRED (fix the one missing line), while an intrinsic with no emitter anywhere is NOT IMPLEMENTED (the program is asking for a feature that does not exist). Measured the same day: __q4k_sb_dot was the first, __simd_vload_i64_x4 and __simt_thread_id are the second and are correctly refused.
2026-09-03	LN46	lesson	Two hand-counted string lengths (52 and 68) sat beside their literals at the forward-const site, the exact drift LN27 removed elsewhere; nx_diag_puts measures the string itself. ★A HAND-COUNTED LENGTH BESIDE A LITERAL IS A SECOND COPY OF THAT LITERAL SHAPE AND THE TWO DRIFT SILENTLY.
2026-09-04	LN35	measure	MEASURED 2026-09-04, corpus_complete=1: the wasm32 address wrap is 27 SITES across FOUR files -- nx_wasm.nx 14, nx_wasm_scalararm.nx 10, wasm.nx 3, plus the opcode-table entry in _hdl_build/nx_wat_compiler.nx (i32.wrap_i64 -> 17). The memory declaration is already a DATA mechanism to copy rather than invent: wat_mem_shared reads `static nx_wasm_shared_req` via wat_global_i64 and wat_mem_pages_max refuses a missing maximum BY NAME, with WAT_PAGES_SPEC_MAX=65536 enforced by wat_die saying the module could never instantiate -- a message that becomes FALSE under memory64 and must itself become flag-aware.
2026-09-04	LN35	queue	EXECUTABLE WORK ORDER, so the next seat does not re-derive it. DO NOT hand-edit 27 wrap sites: extract ONE helper wat_addr_narrow(o, ind) that emits i32.wrap_i64 under wasm32 and NOTHING under memory64, then migrate all 27 call sites to it. Rationale is the failure mode, not tidiness -- a single MISSED wrap under memory64 is a SILENTLY TRUNCATED POINTER, and 27 hand edits guarantee one is missed. The wasm32 path then proves its own neutrality: with no declaration the emitter must produce BYTE-IDENTICAL WAT to today, which is LN35's own done-rule. Order so every intermediate state is safe: (1) add wat_mem64 reading `static nx_wasm_memory64_req: i64 = 1`, mirroring wat_mem_shared; (2) add wat_addr_narrow and migrate all 27 sites while the flag is still always-off, proving byte-identical output; (3) ONLY THEN emit `(memory i64 MIN MAX)` in both forms and widen the ceiling to the wasm64 limit; (4) teach nx_wat_compiler the memory64 limits flag and the VM twin. UNTIL STEP 3 THE FLAG MUST REFUSE BY NAME rather than emit a 64-bit memory over wrapped addresses -- a module that declares memory64 and silently truncates is worse than one that cannot declare it at all.
2026-09-04	LN35	land	STEP 2 OF THE WORK ORDER LANDED AND BUILD-PROVEN, both WAT emitters. 22 of the 27 address-narrow sites collapsed into ONE wat_addr_narrow(o, ind) helper: nx_wasm.nx 12 of 13 (45966 to 46804 B) and nx_wasm_scalararm.nx 10 of 10 (36933 to 37668 B), the twin done in the SAME pass because a fix that lands in one organ and not its sibling is half a fix. Every edit predicted its byte delta and every prediction was EXACT: form A 19 B per site, form B 29 B per site, and the partitions reconcile (4+7+1 and 2+7+1). Builds GREEN: nx_compile_wat 646076 B sha 81493399, nx_compile_wat_scalararm 640822 B sha be37a2fe. The flag static wat_mem64_on is declared and permanently 0, so emitted WAT is unchanged BY CONSTRUCTION -- the helper body is byte-for-byte what wat_at_line does. HONEST GAP: the byte-identical-WAT proof is NOT yet run, because nx_behaveprobe needs a staged artifact and nx_stage_alias only aliases an existing .elf.new that /api/build normally writes; the sovereign lane writes buildroot/_build instead, and forcing it would mean a TOOLCHAIN promote, which is a canaried lane. So this is COMPILES-GREEN, not PROVEN-NEUTRAL.
2026-09-04	LN35	lesson	THE 27th SITE IS NOT AN ADDRESS NARROW AND MUST NOT BE FOLDED IN. The i32.wrap_i64 inside the emitted $nx_wasm_mmap helper converts the PAGE COUNT for memory.grow, not an address; under memory64 memory.grow takes i64, so it changes for a DIFFERENT reason. Folding it into wat_addr_narrow would be one name serving two unrelated decisions, which can then never be tuned for either -- and LN35's own done-rule already lists the mmap helper separately. Three more sites live in wasm.nx and are NOT migrated pending a liveness check, and one grep hit is the opcode-table entry in nx_wat_compiler.nx, which is a decoder row rather than a call site. PARTITION OF THE 27: 22 migrated, 1 deliberately excluded, 3 unmigrated-pending, 1 not-a-call-site.
2026-09-04	LN33	measure	THE FIRST EXTERNAL LIAR-KILLER HAS RUN AGAINST OUR SOVEREIGN WASM, AND IT PASSED. Subject: the served craft_mt.wasm, fetched over https at http=200 application/wasm 263990 B. Oracle: wasm-validate 1.0.39 (WABT), running OUTSIDE the estate exactly as the standing order requires -- it grades our bytes and never enters the build path. VERDICT: `wasm-validate --enable-all` accepts the module. THAT IS A SECOND METHOD CLASS: we did not certify our own wasm, an independent implementation of the specification did, which is precisely what our single-lens internal referee structurally cannot provide. THE FEATURE ENVELOPE, MEASURED BY BISECTION RATHER THAN ASSERTED: at MVP the module is REJECTED with `error: memory may not be shared: threads not allowed` at offset 0x000d5, and with --enable-threads it validates clean. So our shipped wasm requires EXACTLY ONE post-MVP proposal -- threads/shared memory -- and nothing more exotic. ★AND THE REFUSAL IS THE POSITIVE EVIDENCE: LN33 CLAIMED the wasm lane lowers atomics over a shared memory THE MODULE DECLARES, and a module that did not declare one would have validated FINE at MVP. The MVP failure is therefore an external confirmation that the shared-memory declaration is genuinely in the emitted bytes, not merely in our emitter's intentions. ⚠METHOD CORRECTION ON MY OWN COMMAND, recorded because it would have produced a false reading: I piped wasm-validate through `head`, so every `exit=$?` in that output is HEAD's status and not the validator's -- all three printed 0 including the failing case. The ERROR TEXT discriminates; the exit line does not. Same family as the truncating-consumer law: never put a filter on a call whose status you intend to interpret.
2026-09-04	LN13	measure	THE NISHILANG GAP IS NOW A PROVEN FACT WITH A RANK, NOT AN AREA. The estate ranker over this board reads rungs 51 done 42 open 9 with the partition summing, and for TARGET VERSION 2.0 at milestone M3 exactly ONE rung is on the critical path: LN13 capturing closures. Every other open rung ranks as later. The watch symbol parse_closure_capture is ABSENT-PROVEN over buildroot/runtime with matches 0, coverage_complete 1, corpus_complete 1 and no truncation marker, which is the only state in which absence may be asserted, so this is a real missing language feature and not an unwired one. Priority 800 from value 4 momentum 2 cost 10, deficit 4 against the rival columns, cluster 2, and the self-sufficiency row reads SOVEREIGN-NO-PENALTY because nx_parse carries no outside dependency.
2026-09-04	LN13	queue	DELIBERATELY NOT STARTED IN THIS SESSION, AND THE REASON IS THE SUBJECT NOT THE EFFORT. The contract is closures capturing BY VALUE into a compiler-emitted environment struct, with a gate proving a captured counter increments across calls and a capture of a moved value is refused once LN4 lands. That is parser plus environment layout plus codegen, estimated at 2 units with dependency LB0, and it lands in nx_parse which is the organ that builds every other organ in the estate. The standing law for this surface is that every intermediate state must compile and that the toolchain moves only through the canaried promote lane, alone, with nothing else building. Half-landing it at the end of a long session would put the whole build farm behind a partially applied parser change, which is the one failure this estate cannot absorb. The honest next step is a session that starts with this rung and nothing else.
2026-09-04	LN	measure	NISHILANG COMPILE-HEALTH: THE CONTROL-BYTE REFUSAL CLASS IS VERIFIED CLEAN AT FULL POPULATION (2026-09-04). nx_ctlbyte_repair DRY over the real source roots reports files=19331 affected=0 insert=0 drop=0 unknown=0 sum=0 RECONCILES verdict=CLEAN. That is the whole-corpus confirmation the 2026-09-03 repair never got: that pass fixed 314 sources which could not compile AT ALL and took refusals 747 to 427, and this says the class has not regrown anywhere in 19,331 files. A source that cannot compile runs no test, so its silence reads as health -- which is why this class deserves a population check rather than a spot one. ★★★★★★AND THE RUN BEFORE IT IS THE LESSON, MEASURED IN ONE PAIR OF COMMANDS: invoked with no roots from CWD=nishihost the SAME organ reported files=17 verdict=CLEAN. Same verdict, same wording, same exit -- from a population 1,137 TIMES SMALLER and the wrong tree. A GREEN OVER THE WRONG CORPUS IS BYTE-INDISTINGUISHABLE FROM A GREEN OVER THE RIGHT ONE, AND ONLY THE files= FIGURE DISCRIMINATES THEM. ★CREDIT WHERE THE DESIGN EARNED IT: the organ did NOT hide this. It printed `roots=runtime runtime/_hdl_build (DEFAULT -- name roots explicitly when the CWD is not the source tree)` on its own first line, so the trap was visible in the receipt and cost one re-run rather than a false estate-wide claim. That is the same CWD-relative class this session fixed in nx_swcompare_matrix, and it is the correct handling of it: an organ that cannot know its caller's CWD should ANNOUNCE its assumption rather than silently resolve. ⚠WHAT IS STILL UNMEASURED AND WHY I DID NOT MEASURE IT: the residual 427 refusals from the 09-03 census are NOT control-byte and their causes are unenumerated. Naming them needs nx_langcensus, which COMPILES EVERY top-level program (about 13,721 of them) and is NOT build-admission gated -- so running it during the current degraded-array storm would route hours of compile I/O around the very governor protecting those disks. DEFERRED DELIBERATELY, not forgotten, and the cheap unblock is named: the census takes an explicit <cc.elf> and REFUSES to guess a compiler (a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape as above), so it can be run on the idle laptop farm against buildroot/_offc/nx_cc_sovereign.elf the moment either the array recovers or a seat has hours to spend.
2026-09-04	LN13a	land	SHIPPED AND PROVEN ON THE DEPLOYED ARTIFACT. wat_die_unlowerable added to BOTH emitter twins nx_wasm.nx and nx_wasm_scalararm.nx, composing the incumbent wat_die so the file keeps exactly ONE exit path, and scoped to the no-arm fallthrough ONLY. The OP_SYSCALL arm above it still emits i64.const 0 and still stores its result, because that no-op is DECLARED behaviour for non-mmap syscalls and shipped modules pass through it harmlessly; the rule is no arm at all, never an arm I judge incomplete. Sources landed on the NAS hash-verified against the laptop, nx_compile_wat promoted a811c7f0a5a26dca at 646721 bytes with prev banked, gate nx_wat_refuse_gate promoted b09ead8e07fbffb8 at 38663 bytes and REGISTERED, and the gate then ran ON THE NAS against the LIVE compiler at 14 of 14 GREEN.
2026-09-04	LN13a	measure	NEUTRALITY AND THE BITE, BOTH MEASURED, NEITHER ASSERTED. Whole-population sweep of every wasm-targeted source in buildroot runtime with the pre-fix and post-fix compilers: population 85, identical 84, differs 0, refused 1, and the partition sums to 85. The shipping beach module nx_wasm_craft.nx emitted 10045460 bytes BYTE-IDENTICAL across both compilers. The single refusal is nx_video_codec_v1_adapter.nx at opcode 144 in nx_codec_encode, which is a REAL pre-existing silent miscompile and not a regression: nx_codec.nx line 115 calls through the encode_fn vtable slot declared on line 86, so every codec encode through the wasm lane silently returned zero while the build exited 0. Nothing feeds that adapter to the wat lane today so no live build breaks. The promote ruler read lost_from_live 4 with lost_srcpath 0, and all four are adjudicated: three are parser diagnostics superseded by strictly richer replacements visible in the GAINED list, and the fourth is the silent marker itself, whose removal IS the deliverable.
2026-09-04	LN13a	lesson	A BUILD FOSSIL IS NOT A FRESH MEASUREMENT, AND IT NEARLY SENT ME AT THE WRONG OPCODES. My first refuting experiment found the silent marker PRESENT in three emitted artifacts at opcodes 46 and 47, which reads as proof that a blanket refusal would break shipping builds. Both are atomics, OP_ATOMIC_STORE_I64 and OP_ATOMIC_CAS_I64, and the current emitter dispatches all five atomic ops at lines 584 to 588: those .wat files are pre-LN33 fossils in _build, emitted by a compiler that predates the arms. The evidence was true and its subject was stale. Re-emitting rather than reading fossils is what turned a false blocker into the real finding at opcode 144.
2026-09-04	LN13a	lesson	A TOOTH THAT PASSES FOR THE WRONG REASON IS AS DANGEROUS AS ONE THAT FAILS, AND ONLY THE BITE FOUND IT. My first gate asserted the refusal named its opcode by searching the merged capture for the bare substring 144. That tooth PASSED against the pre-fix compiler, because the silent marker it emits is literally ;; TODO opcode 144 -- so the one tooth meant to convict that binary was satisfied by the very string that proves it guilty. Fixed to the contiguous phrase cannot lower IR opcode 144, after which the pre-fix run moved from 9 of 14 to 8 of 14. A gate that has only ever been run against the fixed binary would never have shown this.
2026-09-04	LN13	measure	THE ROLLBACK CAUTION RECORDED AGAINST THIS RUNG IS TOO STRONG AS STATED, AND THAT CHANGES WHAT THE NEXT SESSION MAY ATTEMPT. A bad nx_parse.nx SOURCE is harmless to the live compiler until promoted: sbr_is_toolchain returns 1 for the five toolchain names so no build can install a compiler even under --install, and /api/promote_toolchain validates ELF magic and size BEFORE any rename, rotates prev to prev2, canary-compiles AND runs, and auto-rolls-back. Two generations survive. The dangerous half is the SOURCE EDIT and only to the 33 importers of nx_parse.nx, which is what the declarations-first edit order exists for. Three qualifications stand: the canary is 8 fixed integer checks with NO function pointers at all so it is structurally blind to LN13 and must not be counted as coverage; nx_cc_equiv_gate must be invoked EXPLICITLY on the staged artifact and only rows 10 passed 10 selfhost 1 accepted; and ma_do_promote_toolchain tests only sz == 0 while md_tc_install returns -2 on a provenance refusal, so a promote can return HTTP 200 TOOLCHAIN-PROMOTED with bytes -2 having installed nothing -- READ bytes ON EVERY PROMOTE RECEIPT.
2026-09-04	LN13a	lesson	MY OWN FIRST FLEET CENSUS WAS LESS THAN HALF THE POPULATION AND REPORTED A CONFIDENT ZERO. Paging a job artifact by trusting an empty next= field stopped at the READER's byte cap rather than at end of file, giving 683 rung rows over 67 domains with lang.plan missing entirely, from which the duplicate-rung-id census returned zero collisions. Re-paged with explicit offsets and small windows the real population is 1438 rung rows over 106 domains, lang's 60 rungs present and matching a direct count, and the true answer is 4 collisions in 2 domains. AN EMPTY CONTINUATION FIELD IS NOT PROOF OF EXHAUSTION, and a census that silently stops early fails in the flattering direction.
2026-09-04	LN	measure	WHOLE-POPULATION NISHILANG COMPILE CENSUS, RUN AND RECONCILED (2026-09-04). LANGCENSUS programs=13784 ok=13377 err=400 hang=7 harness=0 sum=13784 RECONCILES rows_written=547305, verdict=NO-REGRESSION with the organ correctly declaring itself a BASELINE rather than a judgement because no prior census was given. So 407 programs cannot compile at all, against the 427 the 2026-09-03 pass left behind. ⚠SCOPE LABELLED, NOT GLOSSED: this is the LAPTOP corpus at 19,458 files, not the NAS tree, so the 427-to-407 movement is NOT a proven improvement -- the two populations are not known to be identical and I did not compare them. What IS proven is the partition: every one of 13,784 programs landed in exactly one class and the sum reconciles. WHY IT RAN ON THE LAPTOP AT ALL: nx_langcensus COMPILES EVERY top-level program and is NOT build-admission gated, so running it on the NAS during the current degraded-array storm would have routed hours of compile I/O around the very governor protecting those disks. It ran instead on 16 idle cores against buildroot/_offc/nx_cc_sovereign.elf at ZERO NAS cost, which is the laptop-farm lane doing exactly what it was built for. ★CREDIT TO THE ORGAN'S OWN DESIGN: it REFUSES to guess a compiler, because a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape that made a 17-file ctlbyte scan and a 19,331-file one print the identical CLEAN verdict earlier today. THE WORKLIST IS RANKED AND ONE CAUSE DOMINATES: `this block is opened here and never closed` at n=51 is roughly an eighth of every error in the estate from a SINGLE class, and LN41 already made that diagnostic name its own brace, so these 51 are precisely located rather than hunted. Behind it: undefined names (a long tail of n=1, each a genuinely missing symbol), ARITY MISMATCHES that are real call-site defects (wm_run called with 7 where it takes 8, vv_deblock and vv_deblock_plane with 4 where they take 5, ss_build_terms with 4 where it takes 5), 9 sites that compute a value and never use it so the work is thrown away, and DUPLICATE DEFINITIONS including nx_ts_verdict_is_valid defined THREE separate times at lines 6635, 6672 and 7691. ★★★★★★THIS IS THE LARGEST REFUSAL CLASS IN THE ESTATE AND IT IS INVISIBLE TO EVERY GATE BY CONSTRUCTION: a source that cannot compile runs no test, so its silence reads as health. 407 programs are currently contributing exactly nothing to any green anywhere, and until today nobody could name one of them. OWED: re-run against the NAS corpus when the array recovers and pass THIS run as the baseline argument, which turns the census from a snapshot into the regression detector it was written to be.
2026-09-04	LN	retract	PARTIAL RETRACTION OF THE CENSUS I JOURNALED TWENTY MINUTES AGO, WITH A CONTROL IN BOTH DIRECTIONS. I published programs=13784 ok=13377 err=400 hang=7 and labelled it LAPTOP corpus, which was the right hedge, but I then treated the 51 unclosed-brace rows as a worklist of ESTATE defects. THEY ARE NOT ALL ESTATE DEFECTS AND I CAN NOW PROVE IT BOTH WAYS. NEGATIVE CONTROL, a row that is NOT a real defect: nx_rv64_amo_gate.nx measured 8335 bytes on the laptop against 7491 on the NAS. Pulling the NAS copy and recompiling it with the SAME compiler produced a clean run -- nx_dce functions=287 live=141 pruned=146, no brace error at all. The ERR belonged to the LAPTOP COPY, not to the estate. POSITIVE CONTROL, a row that IS real: abr_t2.nx is 773 bytes on BOTH sides, byte-for-byte the same size, and its tail ends mid-token on the bare characters `std` -- a genuinely truncated source that is broken in the estate itself. ★★★★★★SO THE CENSUS IS A VALID MEASUREMENT OF THE CORPUS IT SCANNED AND AN INVALID ESTATE FIGURE, AND THE DIFFERENCE IS INVISIBLE FROM THE OUTPUT: every ERR row looks identical whether its cause is a real defect or local rot in a stale mirror. ATTRIBUTION IS PER FILE AND THE PROCEDURE IS CHEAP NOW THAT THE INBOUND DOOR EXISTS -- pull the NAS copy, recompile, and compare; roughly twenty seconds each. ⚠THE TRAP THIS AVOIDS IS SPECIFIC AND EXPENSIVE: 51 rows presented as a fix-list would have sent the next seat editing sources that are ALREADY CORRECT ON THE NAS, and every such edit would have shipped laptop rot INTO the estate under the banner of fixing it. A STALE MIRROR PRODUCES ERRORS THAT ARE INDISTINGUISHABLE FROM DEFECTS, AND THE ONLY DISCRIMINATOR IS A FRESH PULL. WHAT SURVIVES UNCHANGED: the partition still reconciles at 13784, the census organ behaved correctly throughout, and the class RANKING is still the useful output -- unclosed-brace dominating at n=51 is a real signal about where errors cluster even when individual rows need attribution. WHAT IS OWED, and it is now the only honest way to get an estate number: re-run the census against the NAS corpus when the array recovers, passing this run as the baseline argument. Until then NO estate-wide refusal count should be quoted from it, including by me.
2026-09-04	LN	measure	THE 51 UNCLOSED-BRACE ROWS ARE ATTRIBUTED AND THE PARTITION RECONCILES, WHICH DISCHARGES WHAT MY RETRACTION LEFT OWED. ATTRIB51 declared=51 examined=51 banked=51 compiles_after_pull=43 still_err=7 pull_failed=1 sum=51. Method: bank the laptop copy, pull the NAS copy over it through the inbound content lane, recompile with the same compiler, classify. So the estate has SEVEN unclosed-brace sources, not fifty-one, and 84 percent of that census class was stale laptop mirror exactly as the negative control predicted. The seven real ones are abr_t2.nx, nx_antipattern_catalog.nx, nx_fbo_s2.nx, nx_flg_t2.nx, nx_frp_t1.nx, nx_delivery_report.nx and nx_gen_authz_gate.nx. The single PULL-FAILED row is nx_vcodec_dct2_rd_gate.nx, answered CG-IO cannot open source, i.e. a laptop-only file absent from the NAS entirely -- it stays in its own bucket rather than being folded into either real class, because a row you could not attribute is not a row you may count. ROOT CAUSE FOUND AND IT COLLAPSES 42 OF THE 43: those files carry the marker MIGRATED onto nx_gate_verdict by nx_gate_dry_apply, and the D001 minimal-form substitution is defective in TWO ways at once. It leaves the gv_verdict call INSIDE the enclosing if pass==1 block, CONSUMES that block's closing brace so the function is never closed, and DELETES the RED emission branch outright. Proven by reading the source, not inferred from a diff: in nx_gen_authz_gate line 40 opens if pass==1, line 50's brace closes THAT, and main is never closed, which is why the compiler names line 21. A sibling still on its pre-migration NAS copy retains g_puts verdict=RED at line 77 while the migrated copy contains the string zero times. ★★★★★★THE LOUD HALF OF THAT DEFECT IS WHAT STOPPED THE SILENT HALF FROM SHIPPING. Had the brace arithmetic been right, these gates would compile and print NOTHING AT ALL when they fail -- a gate whose exit code and output both vanish on the RED path -- and nobody would have found it by reading a green board. The compiler refusing is the only reason 42 of 43 never reached the estate. ONE DID REACH IT: nx_gen_authz_gate was broken ON THE NAS and could not build at all. FIXED AND SHIPPED THIS SESSION, not filed: hand-migrated onto PER-TOOTH gv_check rather than restoring the pre-migration copy, because the machine form set ctr[0]=pass and ctr[1]=1, and a one-state judge reports passed 1 of 1 and cannot say which conjunct dropped. It now runs 5 of 5 GREEN with both deny cases named neg-control- so the L2 census can see them, emits five values through gv_kv for independent adjudication, and carries its verdict in its exit code. NAS artifact verified at 3859 bytes, not trusted from the receipt -- nx_fs size still served the pre-write 2928 for a minute afterwards, the read path lagging the write path on this surface too.
2026-09-04	LN	retract	PRECISION AND ONE SELF-INFLICTED CENSUS ERROR ON THE ROW ABOVE, PLUS THE SILENT-DEFECT SCARE RESOLVED TO NOTHING. FIRST THE ERROR, BECAUSE IT IS THE INSTRUCTIVE PART. I sized the migrated population by grepping the marker AFTER the attribution run had already pulled 43 NAS copies over their laptop twins. Those NAS copies are PRE-migration and carry no marker, so the very files whose defect I was measuring had silently left the population, and the sweep returned MIGSWEEP examined=841 compiles=834 brace_broken=1 -- a reassuring number produced by a census whose reference I had re-baselined myself, one hour earlier, with my own repair. ★★★★★★A CENSUS RUN AFTER A REPAIR MEASURES THE REPAIR, NOT THE DEFECT, AND IT FAILS IN THE FLATTERING DIRECTION. Reconciled against the banked originals the true population is 885 = 841 surviving on disk + 44 banked pre-pull, and the brace-break rate is 44 of 885, about 50 per thousand. That partition closes exactly: of the 44, 42 have clean pre-migration copies on the NAS so the broken migration never shipped, 1 is nx_gen_authz_gate which DID ship and is now fixed, and 1 is nx_vcodec_dct2_rd_gate which the inbound door answered CG-IO cannot open source, i.e. laptop-only. 42 plus 1 plus 1 is 44. SECOND, THE SCARE I DID NOT PUBLISH AND WHY. Having found that the migration deletes the RED branch, I suspected a fleet-wide SILENT defect: gates that compile but emit nothing when they fail. A first-draft 12-line context grep answered 217 files. I refused to publish it and tested it properly, and both refinements collapsed. A brace-depth counter over all 841 returned 28 non-conforming files, but it also returned NEGATIVE depths, which is a counter telling you it cannot parse -- braces inside string literals. Hand-adjudicating two of the 28, nx_library_gate and nx_media_state_gate, found the gv_verdict call sitting unconditionally at the end of main in BOTH: two hits, two false positives. So no count is published for that class at all. ★★★★★★THE DETECTOR ALSO MATCHED ITS OWN NEEDLE -- nx_gate_dry_apply.nx appears in its own suspect list because the tool carries the marker as a template literal, the same self-counting defect the gatelaw census hit. WHAT IS PROVEN AND WHAT IS NOT, STATED SEPARATELY. PROVEN: the defect is real, its rate is 44 of 885, and its manifestation is a COMPILE FAILURE rather than a silent one -- the lost brace and the deleted RED branch happen in the same substitution, so the compiler catches the pair. Measured directly on the banked originals, 42 of the 44 place the gv_verdict call inside a conditional and 2 do not. NOT PROVEN and deliberately unquantified: whether any gate in the compiling population emits nothing on RED. The two candidates I checked by hand say no, and a crude counter is not evidence either way. THE STANDING CONCLUSION IS UNCHANGED AND IS THE REASON THIS WAS CHEAP TO FIND: the compiler refusing is the only reason 42 of these never reached the estate, so the loud half of the defect is what stopped the silent half from shipping.
2026-09-04	LN	land	SECOND REAL DEFECT REPAIRED AND SHIPPED, AND IT IS THE HALF-LANDED-EDIT CLASS CAUGHT IN THE WILD. nx_antipattern_catalog.nx was byte-identical on both trees at 36526, so it was an estate defect and not laptop rot, and it could not compile at all -- meaning a 162-pattern registry plus a mechanical scanner with its own liar-kill controls has been contributing nothing to any green. DIAGNOSIS BY INDENTATION VERSUS COMPUTED BRACE DEPTH, which located it in one pass: divergence begins at line 459 where the author's indentation says depth 1 and the braces say 2. The cause sits at line 458, a comment TRUNCATED MID-WORD reading `SUBMITGATE mode:` followed by a bare backtick and a partial identifier, and the closing brace of the `if argc >= 3` block opened at line 319 was lost together with it. That is precisely the atomicity failure this estate already has a law for -- a multi-part edit over a flaky transport where one part lands and the next does not, leaving an unclosed brace in a live source. REPAIR WAS THE BRACE ONLY. The SUBMITGATE mode was never written and I did not invent it: writing code to a spec I do not have is fabrication, not repair, and the four argv modes above plus the no-arg self-test are untouched. PROVEN BY RUNNING, not by compiling: NX-ANTIPATTERN-CATALOG GREEN with its own controls firing -- dirty control tripped at 11 hits, ghost file scored 0, mmap-in-loop positive control 1 and negative control 0. Shipped to the NAS under compare-and-swap at 37103 bytes from 36526. THE REMAINING FIVE ARE A DELIBERATE QUEUE, NOT AN OVERSIGHT, AND EACH IS TRUNCATED MID-TOKEN WITH ZERO IMPORTERS: abr_t2.nx degenerates into a repeating std_pdec triple and stops mid-identifier on `std`; nx_fbo_s2.nx stops at `let fib1:`; nx_frp_t1.nx references fib3 through fib9 which are never defined and stops at `return`; nx_delivery_report.nx stops at `last_`; and nx_flg_t2.nx is not NishiLang at all -- it is Go or C syntax, `for i := 0; i < len(str); i++` with `
2026-09-04	LN	retract	I WROTE THE LAW THIS MORNING AND THEN BROKE IT MYSELF WITHIN THE HOUR, AND ONLY A SIZE CHECK STOPPED ME SHIPPING ROT INTO THE ESTATE. My own retraction row said, in these words, that 51 rows presented as a fix-list would send the next seat editing sources that are ALREADY CORRECT ON THE NAS and would ship laptop rot INTO the estate under the banner of fixing it. I then took the 6 OTHER-broken rows from my 841-gate compile sweep, diagnosed iv_list as called with 3 arguments where it takes 4, fixed all 5 call sites across nx_estate.nx and nx_pantry.nx, watched all 4 blocked gates go from BROKEN to COMPILES, and was one command from writing it to the NAS. The only thing that caught it was reading the NAS size first: 10226 bytes there against 8032 in my hand. THE NAS COPIES ALREADY PASSED IV_IDCAP AT ALL FIVE SITES. Had I shipped, I would have overwritten 2194 bytes of correct estate work with a stale-derived file, and the compare-and-swap guard would NOT have saved me because I would have supplied the matching expect value myself. ★★★★★★A COMPARE-AND-SWAP TOKEN PROVES NOBODY ELSE CHANGED THE FILE; IT PROVES NOTHING ABOUT WHETHER YOUR OWN CONTENT IS DERIVED FROM THE CURRENT ONE. THE FULL RE-DERIVATION, EVERY ROW PULLED FRESH BEFORE JUDGEMENT: all 7 broken rows in that sweep are laptop-tree artifacts and ZERO are estate defects. Four are the iv_list arity, already correct on the NAS. One is nx_lib_research_alias_gate reporting two definitions of nx_lib_ingest_buf, and on the NAS there is no duplicate at all -- nx_lib_ingest.nx is a COMPLETELY DIFFERENT ORGAN there, a local-file ingest into the research library, because a dedupe on 07-21 already resolved this and nx_lib_http.nx carries a comment saying so. My laptop simply held the stale pre-dedupe copy. One is nx_meta_refresh_gate, which the inbound door answers CG-IO cannot open source on BOTH trees: it does not exist in the estate at all. One is nx_vcodec_dct2_rd_gate, likewise absent. ⚠AND I NEARLY MISJUDGED THE LAST ONE THE SAME WAY TWICE: I renamed a colliding local streq, re-pulled to check, got COMPILES CLEAN and almost called the collision laptop rot -- but the pull had FAILED and I had redirected its output to /dev/null, so I was compiling MY OWN PATCHED FILE and reading it as evidence about the estate. NEVER SUPPRESS THE ERROR CHANNEL ON A CALL WHOSE SILENCE YOU INTEND TO INTERPRET, a law already in this file, broken by me here. WHAT THIS CHANGES: three items I published as owed estate work -- the iv_list arity blocking 4 gates, and two duplicate-definition defects -- DO NOT EXIST. Of 841 dry_apply-migrated gates measured on the laptop, the number broken in the estate is ZERO. WHAT STANDS UNCHANGED, because it was derived the right way: the 7 STILL-ERR rows from the attribution were each tested AFTER a fresh NAS pull, so they are real; 2 are fixed and shipped and 5 remain. ★★★★★★THE DISCIPLINE THAT WORKED IS NOT A RULE, IT IS AN ORDERING: PULL FIRST, THEN DIAGNOSE. Every finding I derived from a laptop file before pulling was wrong, and every finding I derived after pulling was right, with no exceptions in either direction across eleven files today.
2026-09-04	LN	lesson	THE FIVE I QUEUED FOR RETIREMENT MUST NOT BE RETIRED, AND FINDING OUT WHY CHANGED WHAT THE WHOLE UNCLOSED-BRACE CENSUS MEANS. I had them as abandoned generation artifacts with zero importers and proposed reversible retirement. nx_absent over buildroot/runtime, coverage_complete=1 corpus_complete=1, refuted that for one of them immediately: abr_t2 is referenced at nx_forge_rag_ab.nx:117 as ab_leg("rag:T2", "abr_t2", ...) -- a LIVE A/B leg. ⚠MY EARLIER ZERO-IMPORTERS CLAIM CAME FROM A LAPTOP GREP FOR THE QUOTED "abr_t2.nx" AND abr_t2.elf, WHILE THE REAL REFERENCE IS A BARE NAME STRING. A PATTERN KEYED TO THE WRONG VOCABULARY RETURNS A CONFIDENT FALSE ABANDONED, and abandoned is the verdict that authorises deletion. Following the reference settled the class outright: nx_forge_engine.nx:93 does fg_mkpath("runtime/", organ, ".nx", srcpath), so fe_run GENERATES the source at runtime/<organ>.nx, compiles it, and the harness classifies 1=GREEN 2=COMPILE 3=RUN 4=OUTPUT. ★★★★★★THESE ARE NOT ESTATE DEFECTS, THEY ARE BENCHMARK RESULTS, AND THEIR BROKENNESS IS THE MEASUREMENT. abr_t2 failing to compile IS the recorded T2 RAG-arm outcome; deleting it would have destroyed forge data and taken away a subject the next run overwrites. Six generated organs live in runtime/ from that one harness -- abb_t1 abb_t2 abb_t3 abr_t1 abr_t2 abr_t3 -- five compile and abr_t2 does not. Three more match the same shape and are orphaned, no harness naming them: nx_fbo_s2, nx_frp_t1 and nx_flg_t2, the last written in Go/C syntax that could never have compiled in any state, which is precisely what a failed LLM generation looks like. THE ARCHITECTURAL DEFECT, FILED: A GENERATION HARNESS WRITES ITS LLM OUTPUT INTO THE PRODUCTION ORGAN NAMESPACE, SO NO CENSUS CAN TELL AN AUTHORED ORGAN FROM A GENERATED CANDIDATE. The consequence is not tidiness -- it is that the estate's largest compile-refusal class is partly forge output, the headline overstates estate breakage, and the worklist sends the next seat to invent endings for truncated LLM text and commit it to runtime/ as repair. Remedy is a namespace split, generating into knowledge/forge/out/ or similar so every census can partition; until then NO estate compile-refusal figure should be quoted without saying whether forge output was excluded. ⛔I DELIBERATELY DID NOT MOVE THE FILES OR REPOINT THE GENERATOR: that relocates six live benchmark subjects and is the harness owner's call, and absence from buildroot/knowledge is UNPROVEN -- nx_absent returned corpus_complete=0 truncated=1 over that tree, so I cannot claim nothing else references them by path. ★★★★★★AN ABSENCE PROOF THAT DECLARES ITS OWN INCOMPLETENESS IS THE ONLY REASON THIS ENDED IN A FILING RATHER THAN A DELETION.
2026-09-04	LN	land	THE BUS STOP: THE DIVERGENCE GAUGE WAS NEVER DARK, IT WAS LIT AND UNREAD, SO THE FIX WAS TO MOVE ITS VERDICT ONTO THE SURFACE NOBODY CAN SKIP. Before building anything I ran the prescribed pre-flight, and it paid for itself immediately: nx_capsearch over 7348 entries with corpus_complete=1 returned nx_treediff at rank 1, scoring 520648, described in its own words as making laptop-SSOT versus NAS-buildroot drift A REPORT NOT ARCHAEOLOGY, with nx_treediverge_beat beside it as the standing daily gauge and nx_hashdiverge as the content-exact comparer. ★★★★★★I WAS ONE COMMAND FROM BUILDING A FOURTH COPY OF AN INSTRUMENT THE ESTATE ALREADY HAD THREE OF -- I DIDN'T KNOW IT EXISTED IS A RETRIEVAL FAILURE, NOT A DISCOVERY. Then the measurement that reframed the whole session: the beat is ALIVE, firing every roughly fifty minutes, and its latest line published divergent=3387, partition RECONCILES, verdict BIDIRECTIONAL -- NEITHER TREE IS A SUPERSET, a one-way sync in either direction DESTROYS WORK, merge per-file never push wholesale. That is precisely the fact whose absence cost me eleven hand-diagnosed files and a near-miss overwrite of 2194 bytes of correct estate work. THE GAUGE WAS FRESH, CORRECT, AND NOBODY READ IT. A second standing alarm rides the same line and is equally unread: SRCGUARD rc=4 WORK LOST, nine top-level symbols GONE from canonical sources across nx_schema_backfill, nx_softbind and nx_treehash, with the verdict DO NOT DEPLOY FROM THIS TREE, unchanged across every run in the window. WHERE THE GAP ACTUALLY WAS, measured not guessed: pulse.txt is emitted verbatim as the SessionStart additionalContext, so its first line is the first estate fact any seat sees -- and it had not been rewritten since 2026-08-06, TWENTY-NINE DAYS, while still advertising health_index=500 permil as though current. ★★★★★★A STALE HEADER IS WORSE THAN AN ABSENT ONE: AN ABSENT LINE PROMPTS A QUESTION, A MONTH-OLD LINE PRESENTED WITHOUT ITS AGE IS SIMPLY BELIEVED. SHIPPED: nx_pulse_emit, a laptop-local organ that reads the trend line from a LOCAL file (SessionStart must work offline; a guard that needs the backend is absent exactly when a saturated backend is making you impatient), judges it, and REPLACES the stale header while preserving every remaining byte. It replaces rather than prepends because the channel delivers about 2000 bytes and the file already measured 1977 -- prepending would have silently evicted the LIVE LAWS at the tail, the same cliff MEMORY.md pays for. BITE-PROVEN IN BOTH REFUSAL DIRECTIONS, not merely observed passing: over-cap REFUSES at exit 1 with the fixture byte-identical at 2378 afterwards, and an unreadable trend line ABSTAINS at exit 3 leaving the header standing rather than acquitting. ⚠MY FIRST OVER-CAP FIXTURE WAS VACUOUS -- a tr -dc pipeline yielded 460 bytes instead of 1900 so the condition was never reached and the organ correctly WROTE; I caught it only because I asserted the fixture size before believing the outcome. WIRED, because a refresh mechanism that itself goes stale IS the defect it was built to fix: roster row pulse at 3600s in stoproster.json, ten entries, all nine priors preserved, driven by a wire-only pulserefresh.ps1 that fetches and decides nothing. Proven end to end through the roster path, idempotent at 1986 bytes twice, tail byte-identical to the banked original. ⚠TWO LANDMINES HIT AND FIXED IN THE WIRING: the Git Bash chmod reported the installed elf as -rw-r--r-- while WSL, which is what actually execs it, reported -rwxrwxrwx -- MODE IS A VIEW, EXECUTION IS THE PROOF, so I proved it by running the binary; and PowerShell's Set-Content -Encoding utf8 wrote a BOM into the trend-line data file, harmless to a key-anchored search but a latent trap for any positional reader, replaced with a no-BOM writer and re-verified.
2026-09-04	LN	retract	THE SECOND STANDING ALARM IS A FALSE POSITIVE, AND I AMPLIFIED IT TO EVERY SEAT BEFORE I MEASURED IT. An hour ago I put srcguard's own words -- WORK LOST, DO NOT deploy from this tree -- onto pulse.txt, the SessionStart line every seat reads FIRST, on the strength of it being fresh and unread. Then I pulled all three flagged files from the NAS and read them, and ALL NINE reported-lost symbols are DELIBERATE, DOCUMENTED REMOVALS whose justification sits within a few lines of where the symbol used to be. nx_schema_backfill.nx:53 says in plain words that SB_SRCCAP and the private sb_has scanner "were DELETED 2026-08-25, not merely bypassed". nx_treehash.nx:285 carries th_ends_nx only in prose describing the walker's scope. nx_softbind.nx:30 and 63 and 125-128 remove the six SB__CHEST constants because "CHEST IS NOT A ROW HERE. It is derived from the oracle bands below", calling the old table "exactly the duplicate-ruler defect this file already retired once", with an arithmetic-equivalence claim beside it. TRUE POSITIVES ON THE LIVE POPULATION: ZERO OF NINE. ⚠MY FIRST CHECK WAS ALSO THE WRONG ONE AND NEARLY GAVE ME A FALSE REFUTATION IN THE OTHER DIRECTION: I grepped for the symbol names and read three as PRESENT, but a grep counts MENTIONS while srcguard tracks DEFINITIONS -- all three "present" hits were comments. srcguard is RIGHT that the symbols are gone and WRONG about what that means, and only reading the lines separates those two. THE HISTORY IS THE FINDING. Debt 1785445449 records that srcguard v1 ruled on BYTES, fired wrong both times on its first day, and was corrected because -- its own author's words -- "a shrink is not a revert; dead code deletion, comment tightening and dedup all shrink a file while the tree gets better, and A GUARD THAT CALLS THAT DESTRUCTION TRAINS EVERYONE TO IGNORE IT." v2 moved to symbol-set containment. ★★★★★★THAT SENTENCE NOW DESCRIBES v2 WORD FOR WORD: A DELIBERATE REMOVAL IS NOT A REVERT EITHER, AND THE FIX FOR A FALSE-POSITIVE RULER REPRODUCED THE SAME DEFECT ONE LEVEL DOWN. With 1785521381, which found the same detector structurally blind to intra-function corruption because the 0x0E event changed zero top-level symbols, this instrument has now been measured wrong in THREE INDEPENDENT DIRECTIONS ACROSS THREE FILINGS -- a recurrence rate, not three mistakes. Filed as a supersede. ⚠AND THE PROPAGATION LESSON IS THE ONE I PAID FOR: RELAYING A DETECTOR'S VERDICT VERBATIM INHERITS ITS FALSE POSITIVES AND CARRIES THEM TO ITS WIDEST AUDIENCE. The boot line now reads srcguard=ADVISORY (cannot tell refactor from revert) instead of an unqualified deploy prohibition, because a permanently-red alarm on the estate's most-read surface would have taught every seat to skip the whole line -- including the divergence figure beside it, which is TRUE and is the reason the line exists. ⛔WHAT I DID NOT DO, DELIBERATELY: I did not ship a fourth ruler. The obvious mechanical discriminator -- does the removed symbol's exact name still appear in the file's prose -- separates only 3 of the 9, because nx_softbind explains its six removals conceptually without naming them, so it is a NOISE REDUCER AND NOT A SOLUTION and shipping it as one would be the fourth wrong ruler in this detector's history. The discriminator that worked was reading the source. Saying that plainly is better than automating a guess.
2026-09-04	LN	measure	THE ESTATE COMPILE-REFUSAL COUNT IS ANSWERED WITHOUT THE ARRAY, AND THE HARDWARE BLOCKER WAS REAL FOR THE METHOD I CHOSE AND NOT FOR THE QUESTION I ASKED. I had recorded this as owed until the RAID recovers, because a whole-corpus NAS compile sweep would route hours of I/O around the very governor protecting degraded disks. That is true of a SWEEP. It is not true of the QUESTION. The estate already publishes knowledge/status/treecanon_nas_hash.mf, 19442 sha256 rows, so joining the laptop census against it answers per-file identity at ZERO array cost -- one 1.8 MB fetch instead of 19442 compiles. ★★★★★★A BLOCKER ATTACHES TO A METHOD, NOT TO A QUESTION -- ASK WHAT ELSE ALREADY MEASURES THE THING BEFORE ACCEPTING THAT IT CANNOT BE MEASURED. FOUR CORRECTIONS BEFORE THE NUMBER WAS HONEST, each caught by a control rather than by care. (1) The first join returned 400 of 400 NAS-ABSENT, the uniform-failure tell again: the manifest is rooted AT runtime/, so every census path needed that prefix stripped. Proven by abr_t2.nx, whose manifest sha equals the sha the content-get lane returned on pull. (2) The join then measured MY OWN REPAIRS -- the census errors were recorded before I pulled 51 NAS copies over their laptop twins, so IDENTICAL meant identical NOW. Same self-re-baselining as the migsweep, second time in one session. (3) ★★★★★★THE DEEPEST ONE: IDENTITY OF THE ERRORING FILE IS NOT IDENTITY OF ITS CLOSURE. nx_persona_gate.nx is byte-identical to the estate and STILL failed here, because nx_persona.nx, which it IMPORTS, was stale on the laptop. Requiring the whole transitive closure to be identical -- resolving imports the way the builder does, _hdl_build/ first then runtime/ -- took the claim from 284 to 139. A leaf-identity proof cannot carry a closure-level claim. (4) The contamination exclusion was then over-broad in the other direction: it listed nx_syscalls.nx, which nearly every file imports and which the pull returned SAME at 99746 bytes both sides. A PULL THAT CHANGED NOTHING CANNOT CONTAMINATE ANYTHING, so the exclusion had to be narrowed from files-I-pulled to files-I-actually-CHANGED, decided by hashing the banked pre-pull originals. FINAL, AND THE PARTITION RECONCILES AT 284: closure-proven and uncontaminated 135, closure-divergent UNPROVEN 119, excluded because the closure holds a file I changed 30. So the estate carries 135 PROVEN compile refusals from this census, with 119 more that need a pull each before anything may be said about them. THE OUTPUT IS A RANKED CAUSAL WORKLIST, NOT A COUNT, and two causes were worked to zero immediately. FIRST: nx_ts_verdict_is_valid defined in BOTH nx_token_sample.nx and nx_transformer_stack.nx -- a PREFIX collision, nx_ts_ claimed by token_sample and transformer_stack alike, three symbols colliding (NX_TS_OK, NX_TS_N_VERDICTS, nx_ts_verdict_is_valid) and NX_TS_N_VERDICTS holds DIFFERENT VALUES, 5 against 6, so merging them would have been wrong. Measured before touching: ZERO of the 17 blocked programs reference any colliding symbol -- they merely import both modules, so the collision lives in the closure and no caller needed changing. NX_TS_OK is 0 on both sides, so the one ambiguous consumer, nx_llm_run_v2.nx which imports both, is unaffected by which it binds. Renamed the transformer_stack side to NX_TXS_/nx_txs_ plus its test: 17 OF 17 UNBLOCKED BY ONE RENAME, both files shipped under CAS. SECOND: five gates each carried a private g_check beside the one nx_gate_emit_lib.nx already provides -- the duplicate-ruler defect that was ALSO a compile error, so nx_codec_provenance_gate and the four roku gates had never built at all. Deleted the local copies; all five compile, and they RUN: codec_provenance GREEN, the four roku gates RED with bytes=0 because their catalog.json fixture does not exist on this laptop, so THE RED IS UNADJUDICATED AND I AM NOT CLAIMING IT EITHER WAY until they run where the fixture lives. ⚠A REAL SECONDARY DEFECT FELL OUT OF THAT RUN: roku R9, named LIAR-KILL: no personal reference, PASSES ON A ZERO-BYTE FILE -- a control that cannot fail on empty input is the tooth-that-passes-on-the-empty-set defect, sitting inside the very row that exists to be the liar-kill. ⚠And one write of the five returned NO JOB ID and had NOT landed; the artifact said so, the receipt did not.
2026-09-04	LN	lesson	THE WORKLIST CONTAINED ROWS WHERE FIXING THEM IS THE DEFECT, AND THAT IS THE MOST DANGEROUS THING A COMPILE-REFUSAL LIST CAN CARRY. Working down the ranked causes I reached expand_imports failed at n=12 and read the files instead of the counts. Two of them say what they are in their own headers. nx_hdlimp_neg_probe.nx: "NEGATIVE control for the resolver fix -- imports a module that exists NOWHERE in the tree. MUST fail expand_imports before AND after the fix; IF THIS EVER BUILDS, THE RESOLVER HAS GONE FAIL-OPEN AND THE FIX IS REFUTED." nx_badimport_probe.nx: "FAIL-OPEN PROBE -- an UNRESOLVED import must be a LOUD ERROR", filed because nx_cc once emitted an EMPTY elf on an unresolved import and three real organs "built successfully" and produced nothing. ★★★★★★A PROGRAM WHOSE PURPOSE IS TO FAIL TO COMPILE IS A PASSING TEST, NOT A DEFECT -- AND A SEAT WHO TOOK MY WORKLIST AND MADE IT BUILD WOULD HAVE DELETED THE CONTROL THAT PROVES THE RESOLVER IS NOT FAIL-OPEN. Same family as the forge outputs found earlier today: in both cases a refusal IS the recorded measurement, and the census cannot see the difference. SEPARATED BY THE FIXTURES' OWN VOCABULARY, never by a name pattern I invented -- NEGATIVE control, MUST fail, FAIL-OPEN, must be a LOUD ERROR, if this ever builds: 7 of 135 are deliberate negative fixtures, 128 remain as candidate defects, and the partition reconciles at 135. ⚠THE 7 IS A FLOOR AND I AM LABELLING IT ONE. z.nx imports "z", and _nxiq_conflict.nx double-imports the same module under two names while _nxiq_noexport and _nxiq_unkns are named for the exact compiler conditions they exercise -- all four are plainly fixtures and NONE carries a marker phrase, so a vocabulary-keyed detector cannot see them. That is the same blindness this estate already recorded: a marker list keyed on the vocabulary of the thing you are detecting cannot see instances expressed in other vocabulary, and the miss reads as "this does not exist" rather than as "my definition is too narrow". ⇒ THE STRUCTURAL REMEDY IS A DECLARATION, NOT A CLEVERER PATTERN: a fixture that must not compile should SAY SO in a machine-readable field the way organ_kind.conf and organ_gate.conf already resolve kind and gate ownership by declaration rather than by name -- the estate reached that conclusion twice before, from the classifier side and from the gate side, and this is the third arrival. Until such a field exists, EVERY compile-refusal worklist must be read by a human before a single row is actioned, and that instruction now travels with the list. ⇒ Worklist written to knowledge-adjacent banks: estate_defects_worklist.txt (128 rows, ranked by cause) and estate_negative_fixtures.txt (the 7 that must stay red). ⚠5 of the 128 are the g_check duplicates already fixed and shipped this session, so the live figure is 123 and the file predates that fix.
2026-09-04	LN	land	THE SOTA MEASUREMENT I HAD BEEN DEFERRING IS LANDED AS COMPARE DATA, AND THE REASON FOR DEFERRING IT HAD EXPIRED. I said earlier today that I would not draw a SOTA comparison through instruments I had just found wrong -- a census overstating estate breakage, a detector at a 100 percent false-positive rate, and a boot surface 29 days stale. That was right when I said it and wrong to keep saying: all three were repaired or characterised in this session, so the justification no longer held. ⚠A DEFERRAL IS ONLY HONEST WHILE ITS PRECONDITION IS STILL TRUE, AND A SEAT THAT REPAIRS THE PRECONDITION MUST GO BACK AND LIFT ITS OWN DEFERRAL RATHER THAN RE-QUOTE IT. WHAT LANDED, in the shape the standing order defines and the shape /compare/browser already ships: a MEASUREMENT AND ITERATION TOOLING section in lang.matrix, 8 rows, every one mapping a real instrument of the compiler field to either an estate organ that EXISTS or a named _ABSENT_ watch. Verified before writing, not after: nx_langcensus, nx_cc_equiv_gate, nx_gate_bite, nx_lang_h2h, nx_srclint and nx_unwired all exist with the symbols named, so the generator will re-measure each on every beat and no cell can rot into a claim. Rows cover the whole-corpus compile census against crater-class ecosystem rebuilds, self-validation against multi-stage bootstrap plus equivalence-modulo-inputs fuzzing [emi2014], mutation testing over the gate fleet, benchmark receipts with a declared control [stabilizer2013], diagnostics against the bar Elm set for errors addressed to a person [elm-errors], expect-fail declaration against rustc compiletest and GCC dg-error and Go errorcheck, and the dead-code census against Go's unused-variable error and Rust's dead_code lint. Only ref keys that ALREADY RESOLVE were cited -- an unresolvable mark turns the refs gate RED, so inventing a citation to dress a row would have broken the very referee that makes the section trustworthy. THREE BUILD CONTRACTS, EACH WITH ITS DONE-RULE PRE-DECLARED BEFORE THE ORGAN EXISTS, admitted as rungs LN47, LN48 and LN49 under a new milestone M6 with ver 4.0 so the ranker prices them: closure-identity scoping (done when the organ reproduces today's 135/119/30 partition AND a planted stale import demotes a PROVEN row -- the second clause is the anti-vacuity tooth, since a scoper that never demotes has not been shown to fire); expect-fail declaration (done when it catches at least one fixture the vocabulary scan MISSED, because reproducing the floor adds nothing); and diagnostic grading (done when a deliberately regressed diagnostic LOWERS the score, so it carries its own negative control). ★★★★★★THE ONLY EXCEED CLAIMED IS THE ONE THE FIELD STRUCTURALLY CANNOT HAVE: no mainstream toolchain scopes a refusal figure by transitive-closure identity across two trees, because they build ONE tree and have never needed to. Everything else is coded PARITY or worse, including mutation testing, where the honest reading is a stronger tool at unproven coverage rather than an exceed. Sizes verified by prediction on both appends -- matrix 87125 to 92922 which is exactly the 5797-byte section, plan 166790 to 169497 which is exactly the 2707-byte rung block -- after an earlier append in this session DOUBLE-APPLIED and was caught only because the delta matched neither one nor two times the new row.
2026-09-04	LN	land	THE EVIDENCE REFEREE WAS RED ON A FALSE POSITIVE, AND THE CAUSE WAS A ONE-BYTE FORMAT TEST. Running nx_compare_refs_gate to check my own compare-data change came back 23/24 RED. My change was clean -- cite-marks-resolve-every-one PASS, marks=3281 unresolved=0, uncited_keys=0, so the section I had just landed broke nothing -- but the gate carried a live failure I had not caused: mirror-incompleteness-ratchet-does-not-rise FAIL, incomplete=1 against a baseline of 0. ★THE GATE HANDED ME ITS OWN WORKLIST rather than a bare count, which is the whole reason it was actionable in one step: knowledge/status/refs_mirror_incomplete.txt named exactly one row, procgen key fastnoise2, mirror rf_51393572.raw, reason json-unterminated, size 6339. THE DIAGNOSIS, from the bytes and the declared url, not from the verdict: the mirror is a GitHub README.md that opens with a badge, "[![GitHub Actions CI](...)](...)", and its first two bytes are 5b 21 -- an opening bracket followed by a bang. mi_classify tested exactly ONE byte: first non-space byte is { or [ means JSON. So it read a markdown document as a JSON array, found that the array never closes, and published json-unterminated against a file that is COMPLETE. ★★★★★★A FORMAT CLASSIFIER THAT KEYS ON THE FIRST BYTE MISREADS EVERY MARKDOWN DOCUMENT OPENING WITH A LINK OR A BADGE -- AND ON GITHUB THAT IS THE NORM, NOT AN EDGE CASE, so the false-positive population is every README mirror we hold. THE FIX IS TWO BYTES WIDE AND CANNOT MISJUDGE REAL JSON: after the opening bracket the next non-space byte must be able to START a value -- quote, brace, bracket, closing bracket, minus, digit, t, f or n. A bang is none of them. No valid JSON can fail that test, so the check is wrong only in the direction of DECLINING TO JUDGE. PROVEN BOTH WAYS ON THE REAL FILE, not on a planted fixture: pre-fix the classifier returns class=1 SUSPECT rcode=5 json-unterminated, post-fix it returns class=3 UNKNOWN rcode=9 no-format-signature-cannot-judge. ★IT ABSTAINS RATHER THAN ACCUSING, AND IT DOES NOT SWING TO THE OPPOSITE LIE EITHER -- it does not claim COMPLETE, because it cannot verify markdown completeness, and an instrument that cannot see must say so rather than acquit. AND THE DETECTOR STILL BITES: nx_mirrorintegrity_gate ran 15/15 GREEN with json-unterminated BITE-PROVEN (fires on bad, silent on good), so genuinely truncated JSON is still caught -- a fix that quiets a false positive by disabling the detector would have been worse than the false positive. ⚠THIS IS THE SECOND MEASURED FALSE-POSITIVE CLASS IN THIS ONE INSTRUMENT: the first was a 941-per-thousand rate on structural completeness, root-fixed after controlling all 17 cited files of a class. A detector bite-proven on PLANTED fixtures is not calibrated on REAL data, and both times the real data was where it broke. ⚠And a self-inflicted trap for the fourth time in this session: the probe read bytes=0 unreadable because I wrote its fixture from Git Bash into a /tmp that WSL cannot see -- the same filesystem split that cost three earlier runs, repeated after I had already journalled it twice. ★I removed the probe from runtime/ when I was done: leaving scratch in the production organ namespace is exactly the defect I filed against the forge four hours ago, and writing the row does not exempt the author.
2026-09-04	LN	land	CLOSED END TO END: THE ESTATE'S EVIDENCE REFEREE IS 24/24 GREEN, AND THE SOURCE FIX WAS ONLY HALF THE WORK. Shipping nx_mirrorintegrity_lib.nx would have left the fix BUILT-AND-UNSHIPPED -- the exact class this session has been documenting all day, where a written and compiled correction is byte-indistinguishable from a bug nobody found. The gate COMPOSES the classifier in-process, so the fix reaches nothing until the gate binary itself is rebuilt. Full chain, every step verified by artifact rather than receipt: /api/build returned BUILT 90400 bytes with src_path naming buildroot/runtime/nx_compare_refs_gate.nx -- READ ON EVERY BUILD, because expect_sha256 proves the staged bytes are the ones just built and says NOTHING about whether the right source was compiled; /api/promote with expect_sha256 returned PROMOTED at that identical sha 3879f57b with prev banked; and the re-run moved the board. THE MEASURED MOVEMENT, and the partition holds at 1275 across it: truncated_suspect 1 to 0, unknown 140 to 141, incomplete 1 to 0, so mirror-incompleteness-ratchet-does-not-rise went FAIL to PASS and the gate went 23/24 RED to 24/24 GREEN. ★THE ROW MOVED SUSPECT TO UNKNOWN, NOT SUSPECT TO COMPLETE, exactly as the pre-ship probe predicted -- the classifier declines to judge a markdown body rather than swinging to the opposite lie, and unknown rising by exactly one is the receipt that the change did what it claimed and nothing else. ⚠THE GATE'S OWN RESIDUAL IS PUBLISHED IN ITS VERDICT AND I AM NOT PAPERING OVER IT: fetch-time provenance proves the mirror is OF the url, never that the mirror SUPPORTS the claim -- 587 of 1275 mirrors remain provenance-unproven, that is a declared human read, and no tooth on this gate measures it. GREEN here means the citations register is well-formed and its mirrors are whole; it does not mean the claims are true.
2026-09-04	LN47	measure	THE COMPARE BOARD'S OWN PUBLISHER WAS STALE FOR OVER THREE HOURS, AND ADJUDICATING THE RESTAGE IS THE SAME DISCRIMINATION PROBLEM THIS RUNG EXISTS FOR. compare_forkfresh.status read ts=1788536768, more than 3.3 hours old, with FORK-STALE nx_swcompare_matrix -- the generator whose CWD fix I had deployed as SOURCE earlier today without rebuilding its buildroot/_offc twin, so every matrix page including the measurement section I had just landed would have published through the old binary. That is the third-twin defect CLAUDE.md records as having cost four seats the same investigation, recurring in my own lane the same day I read it. nx_restage through nx_job_run returned RESTAGED 328449 bytes. THEN THE QUESTION: the promoted binary is 357136 bytes, sha a76b4271, and the fresh fork is 328449, sha d460aa13 -- 28687 bytes SMALLER after an addition, which the standing law reads as a REVERT. A SIZE DELTA IS A QUESTION, NOT A VERDICT, so the content ruler decided it, and its answer was honest about its own limits: lost_from_live=268 partitioned srcpath=19 symbolname=245 sectname=3 other=1, summing to 268; symmetry=BIDIRECTIONAL with 13 runs GAINED; and its own text naming the cause -- most of the loss is compiler-embedded source paths and symbol names, which is what -g adds, a debug and a release build of the same source differing by about 184 permil -- against a measured 180 permil here. The single lost_other, the string RED (a check failed), reappears in the GAINED list with a colon appended: RE-ENCODED, not lost. And the GAINED list carries my own CWD-fix refusal text, .matrix absent from BOTH, plus REGISTRY-MISPOINTED and neg-control-nonzero -- new capability, present in the fork and absent from the promoted binary. ★★★★★★THE FORK IS AHEAD OF THE PROMOTED BINARY AND IN RELEASE FLAVOUR; THE RED IS A FLAVOUR ARTIFACT THE RULER ITSELF PREDICTS, AND THE PROMOTED BINARY IS THE STALE ONE. The regen was launched through it. ⚠WHAT IS OWED AND WHY IT IS THIS RUNG'S BUSINESS: leaf-versus-closure identity and debug-versus-release flavour are the same failure -- a byte comparison whose SUBJECT is wider or narrower than the thing it claims to judge. The ruler's own prescribed control, rebuild the candidate with --debug and re-run, which took nx_hostctl from 332 lost to 2, was NOT run here because the array is degraded and the partition plus the bidirectional symmetry plus the re-encoded lost_other decided it; that control is the definitive one and stays owed. And the promoted binary should be re-promoted from current source so promoted equals fork equals source -- three roots means three checks, and today two of the three disagreed.
2026-09-04	LN47	land	THE COMPARE GENERATOR'S THREE ROOTS AGREE, AND THE LANE-VARIANCE CLASS IS NOW CLOSED THE WAY THE RECORD SAYS TO CLOSE IT. Sequence, each step verified by artifact: /api/build from current source returned BUILT 363888 bytes sha 2b7f4e0c with src_path naming nx_swcompare_matrix.nx and a banked prior stage from another seat; the same-lane content ruler read lost_from_live=2 at 1 permil -- cl_regorgan, a dead symbol name, and RED (a check failed), which reappears in GAINED with its failing conjunct now appended, a re-encoding that is an improvement -- with 27 runs gained including my own CWD-fix refusal text; /api/promote at that sha returned PROMOTED with prev banked. THEN THE STRUCTURAL FACT: a second nx_restage rebuilt the buildroot/_offc fork at 328449 bytes, the same size as the first, because the restage lane and the api/build lane produce different bytes from IDENTICAL source, 9.7 percent apart and inside the measured 6 to 17 percent band. A rebuilt fork can therefore NEVER read FRESH against a promote from the other lane, by construction, and the regen's freshness check was reading that permanent mismatch as staleness. ★★★★★★WHEN TWO LANES CANNOT PRODUCE THE SAME BYTES, FRESHNESS MUST BE ESTABLISHED BY COPY, NOT BY REBUILD -- and the record already said so: nx_filecopy promoted into buildroot/_offc with overwrite, mode preserved. NX-FILECOPY OK bytes=363888 verified=1, destination re-read and compared byte-for-byte, mode_preserved=493. Promoted, fork and source now agree, and the next regen's forkfresh line is the receipt that will show it. The debug-flavour control the ruler prescribes was made unnecessary for this target by the copy, but it stays owed as the general instrument for any target that must be rebuilt rather than copied.
2026-09-04	LN41	queue	A FRONT-END FIX LANDED IN SOURCE BY A LANE THAT DIED BEFORE REPORTING IT, FOUND BY A 4147-BYTE PARSER DIVERGENCE DURING A SHIP (2026-09-04). runtime/nx_parse.nx 433947 -> 438094 B: (1) lookup_enum_type -- a PLAIN enum name (no payload) used in a TYPE position resolves, where before it died as I do not know a type named X; a tagged enum already resolved through its shadow struct, so only payload-free enums were value namespaces that could not be NAMED in a signature, and Result<i64, NetError> did not compile -- measured on runtime/nx_net.nx (8 errors) and runtime/fs.nx (10). (2) A CODEGEN DEFECT in the variant constructor: it returned the alloca id, which is a SLOT, and every as-VALUE consumer dereferences a slot, so return Result::Ok(v) compiled to a load of the shadow's first word and returned the TAG -- Ok(x) came back as 0, indistinguishable from null, Err(x) as 1, a bogus non-null pointer; fixed by emitting a GEP at offset 0 AFTER the stores so the caller receives a materialised address, the sibling half of the bug already fixed in x86ctx_emit_gep. STATUS, MEASURED BY THE SEAT: the fix lives in the parser SOURCE that library-importing organs compile in (nx_wgsl rung 2 links nx_parse and reads 105/105 and 39/39 with it), but the INSTALLED TOOLCHAIN is a prebuilt binary that does not carry it -- nx_net still refuses with 10 errors on the laptop, and nx_cdp_eval, rewritten by the same lane to compose nx_net, is therefore currently UNBUILDABLE. ⇒ UNPROVEN FOR ITS PURPOSE until the toolchain is rebuilt from this parser through the sanctioned lane (nx_cc_equiv_gate 10/10 + self-host GREEN + canary), which the laptop-farm lane must never do. The parser SOURCE is shipped to the NAS under CAS so that source and the nx_wgsl binary agree (a served binary carrying code its source cannot rebuild is the AHEAD class). ACCEPT RULE for the toolchain rung: nx_net compiles clean, a KAT proves Result::Ok(v) returns a pointer whose first word is the tag and not the tag itself, and nx_cdp_eval builds and passes its refusal paths and round trip.
2026-09-04	LN47	land	THE EVIDENCE REFEREE HAD A FIXED READ WINDOW ON ITS OWN PROVENANCE JOURNAL, MY ADMISSIONS CROSSED IT, AND THE GATE ABSTAINED HONESTLY INSTEAD OF ACQUITTING -- WHICH IS THE ONLY REASON THE DEFECT WAS FOUND THE SAME HOUR. Third refs-gate run of the day read 22/24 RED with every substantive tooth passing -- pins matched 1351 of 1351, unresolved 0, uncited 0, incomplete 0 -- and its first line naming its own blindness: PROV-JOURNAL-TRUNCATED, the journal filled this reader's window, so the provenance verdict is UNOBSERVABLE. The two failing teeth were the truncation abstain and the unproven ratchet RISING by 29 -- and all 29 named rows were mine, the LLM and browser mirrors admitted minutes earlier, each of which the fetch lane HAD journalled: they were in the file, past the window, and a reader that cannot see a row cannot count it proven. CAUSE, from the source: CRG_CAP = 262144, ONE constant shared by NINE unrelated reads in the gate, and the journal reached 1306 rows. ★★★★★★A CAP IS NOT A NUMBER TO TUNE, AND ONE CONSTANT SERVING NINE PURPOSES CAN NEVER BE TUNED FOR ANY OF THEM. Fixed the way the record prescribes: the journal read composes sys_read_file, which sizes its buffer from the file and cannot short-read, so the TRUNCATED state is retired by construction and the observed-not-absent-not-truncated tooth keeps only its honest half -- an absent journal still fails it, because sys_read_file returns null on absent and prows stays 0. No other read in the file was touched: the eight siblings each get their own decision, not a widened constant. Shipped under compare-and-swap at 49123 bytes from 47565, built at 92080 bytes sha 6fb249b1 with src_path verified, promoted at that sha with prev banked, and RE-RUN: 24/24 GREEN, jrnl_rows 1306 to 1335 -- exactly the 29 rows the old window hid -- proven 738 to 767, unproven 616 back to the baseline 587 to the row, the truncation line gone. ★THE MOVEMENT IS THE PROOF: a reader that gained precisely the rows it was previously blind to, and a ratchet that fell by precisely that count, is a fix whose effect was predicted before it ran. ⚠THE OTHER EIGHT CRG_CAP READS ARE NOW A NAMED WORKLIST, NOT A FIXED PROBLEM: each register, matrix, plan and sota read in this gate still wears the same constant, and any of them crosses 256 KB the day a board grows enough -- browser.matrix is already 107 rows. Each should compose sys_read_file on its own merits; I fixed the one that was measured broken and named the rest rather than sweeping them blind.
2026-09-04	LN50	land	September 2026 compiler and toolchain SOTA admitted as DATA from the adversarially verified sweep (workflow wf_d98197e2-d2e): 20 refs pinned by fetch receipt (lang.refs 18143 to 27986 B), a section of 15 rows with 13 watch contracts and 2 met-bar rows (lang.matrix 92922 to 101456 B), rungs LN50-LN59 under M7 ver 5.0 (lang.plan 187305 to 191267 B); every append settled by predicted size and proven single by row-unique count on the tail
2026-09-04	LN50	measure	referee nx_compare_refs_gate 24/24 GREEN fleet-wide (job 1788561456): files=103 rows=1454 pins=1390 matched=1390 marks=3530 uncited=0 unresolved=0 provenance proven=806 mismatch=0 unproven=587 unchanged. Sweep attrition: 24 findings, CONFIRMED 17, ALREADY-COMMON 3 (schema validation, Fedora mass rebuild, lit expect-fail vocabulary), REFUTED 2 (ClozeMaster bug count, Alive2 daily dashboard), UNDATED 1 (SARIF 2.2), UNCITABLE 1 (diverse double-compiling in practice); only CONFIRMED items carry watches, the others are bars
2026-09-04	LN54	retract	the first referee run read 23/24 RED on provenance-mirror-url-never-contradicted: the brack row carried a hand-typed URL (Verified-Scheme-Compiler) while the fetch journal holds the URL the mirror was actually taken from (Verified-Compiler-for-Scheme). Corrected in place by one whole-file CAS write; re-run 24/24. The claim was never wrong, the address was
2026-09-04	LN54	lesson	the fetch RECEIPT is the row: it carries the saved path, the sha256 and the URL that was fetched, so a ref row is composed FROM the receipt, never from a URL typed by hand or matched by prefix. The provenance tooth exists for exactly this and it fired on the first try; a receipt-composed row cannot contradict its own journal
2026-09-04	LN52	queue	build order from the cross-domain rank, cheapest proof first: LN52 known-bug id and XPASS (SMALL, on nx_langcensus beside LN48), LN56 schema-validated diagnostics with SKIP, LN55 two-axis peephole harness, then LN50 and LN51 together (object model then snapshot corpus), LN53 rebuild partition, LN54 per-pass certificates (MEDIUM, the credible-compilation rung the field measures at a tenth of full verification), LN57-LN59 behind their named prerequisites; the masked vectoriser and the seed SBOM chain are LARGE watches, third tier
2026-09-05	LN16	measure	an instance of the unchecked-lane crash class found by using the estate as a user, 2026-09-05: nx_goalmap_lib indexes sys_mmap raw arrays sized by guessed caps (GM_MAXWORDS 24, GM_MAXRUNG 512, GM_MAXMAT 512, GM_MAXDOM 16, GM_OUTCAP 16384 which was already raised once from 8192) and the promoted binary SIGSEGVs at 0x401e23 on an 8-board 16-word query while silently DROPPING words past 24 on another; the crash guard itself names the remedy (fixed arrays and slices refuse out-of-bounds with a message); debt 1788626163, engineshift ES21 owns the organ -- the fleet instrument owed here is a census of organs that size raw arrays from a const cap and index them from user input, so this class is counted rather than rediscovered one crash at a time
2026-09-06	LN60	queue	FLAGGED from the gameengine lane (GE59, the cast fragment transcription), which lands only the compiler half here and does not take the census or the research: the compiler fix is three anchored edits on nx_parse.nx (NX_PARSE_GLOBALS_SLACK named; count_global_tokens beside count_func_tokens; parse_module sizes globals_cap from it) and a message-fidelity fix owed in nx_ir.nx, whose three identical ir_add_global_* refusals say `raise the derivation in ir_module_new` -- a hand-copied paraphrase that names the wrong site (parse_module is the allocator for every compiled unit; ir_module_new serves hand-built test modules) and cost one seat the first look. Ship path: /api/build or nx_sov_build_run nx_compile_x86 + nxasm_x86_main (the sibling LN42 assembler change rides along, matched pair), nx_stage_alias to nx_cc_sovereign.elf.new and nxasm_x86_main.elf.new, /api/promote_toolchain each (canary + .prev bank + auto-rollback), then rebuild the consumer. The estate-wide half (every domain's declared numbers) is CQ13 on codequality
2026-09-06	LN60	land	THE COMPILER HALF IS LIVE: nx_parse.nx count_global_tokens (TK_STRING + TK_STATIC + TK_FLOAT + TK_FLOAT_F32 + TK_FUNC) + NX_PARSE_GLOBALS_SLACK=256 replace the declared NX_PARSE_GLOBALS_CAP=4096 in parse_module (three anchored CAS edits, 438094 -> 440388 B); nx_ir.nx's three ir_add_global_* refusals now name parse_module as the derivation site (message fidelity; nx_ir.nx is CRLF, so every cross-line anchor needs a carriage return). nx_compile_x86 built through /api/build (973080 B, sha 42b1602e, src_path verified, src_stable=1; the prior sibling stage 962592 B was banked as .prev by the build itself), bridged to nx_cc_sovereign.elf.new by nx_filecopy (verified, hash equal), and /api/promote_toolchain returned TOOLCHAIN-PROMOTED canary=GREEN prev=1 -- buildroot/_offc/nx_cc_sovereign.elf now hashes 42b1602e. The assembler was rebuilt byte-identical to live (a0dbf8f3, 176048 B) so the pair needed one promote. Remaining under this rung: the nx_wgsl rebuild past 4096 (measurement pending), the planted under-count bite, the census organ and the research/refs (queue row above)
2026-09-06	LN60	measure	THE UNIT THAT STOPPED AT 4097 NOW BUILDS: nx_wgsl (shader front-end + both backends + world + cast vertex + cast fragment slice 1) compiled under the promoted compiler 42b1602e -- 1057504 B debug, sha 8db821ce, 875 subprograms, 18144 debug-line rows -- with no pool refusal, where the same source had stopped at `global pool ... measured 4097 against a cap of 4096` under b89d6092. The guard is unchanged and still armed (ir_add_global_* assert against globals_cap); what changed is that globals_cap is now a pass over the token stream plus a named slack. Owed under this rung: the planted under-count bite (a fixture whose synthesised globals exceed the slack must refuse BY NAME, proving the guard is not vacuous after the derivation), the census organ and the pinned research
2026-09-06	LN61	retract	SCOPE CORRECTION BEFORE ANY WORK STARTS ON LN61 LN62 LN63: THESE THREE LARGELY DESCRIBE CAPABILITY THE ESTATE ALREADY BUILT IN JULY 2026 AND I PROPOSED THEM AS NEW. NISHI-FORGE is the incumbent and it is the same shape: nx_forge is the driver (task spec to pack to model to lane build to BYTE-EXACT judge to bounded repair, ledger appended) gate 5/5; nx_forge_ctx emits the pack FROM SOURCES with live stdlib signatures gate 7/7; nx_forge_model is the model backend proven over live loopback gate 6/6; nx_lib_std is the sovereign libc gate 13/13; the vetted-rules registry carries 16 rows that RETIRE their own stale bans; a coding compare board was authored. Its pilot MEASURED the exact thesis the September literature reports: haiku RAW 0 of 3, haiku plus PACK 3 of 3, fable plus PACK 3 of 3, i.e. harness parity at the small-organ tier, with the lift coming from VERIFIED CONTEXT rather than scale or iteration. So LN61 to LN63 are REPOINTED from build to COMPOSE, and the honest remaining gaps are the ones FORGE itself named and could not reach: N6 BATCHED PREFILL, because per-token prefill at 2.4 tokens per second makes a 1300-token pack about nine minutes per task and that is what actually blocks the local tier, and N3 BEST-OF-N pick-first-GREEN, which the free deterministic verifier makes cheap for us. What September ADDS is not the harness but three corrections to its priorities, recorded in the sibling measure row.
2026-09-06	LN61	measure	WHAT SEPTEMBER 2026 ACTUALLY ADDS TO NISHI-FORGE, WHICH IS NOT THE HARNESS BUT THREE CORRECTIONS TO ITS PRIORITY ORDER. ONE, best-of-N moves to the FRONT. FORGE ranked N3 pick-first-GREEN third; GenCorrect [gencorrect-2609-02849] measures five refine rounds worth 177 points against 161 for ALL post-training on the same model, and 198 points on a model with no code-specific RL at all, so the loop outperforms training and it is the rung our free deterministic byte-exact judge makes cheapest in the estate. TWO, the LOCAL TIER TARGET IS PROBABLY WRONG BY AN ORDER OF MAGNITUDE. FORGE staged Qwen2.5-Coder-0.5B and measured a 0 of 3 floor; HEART [heart-2609-01736] reaches 84 percent task completion against GPT-5.4 at 20 with a Qwen3-8B backbone across Planner, Router, Verifier and the tool primitives. An 8B tier also changes the N6 prefill arithmetic, so the tier choice and the batched-prefill rung must be decided TOGETHER rather than in sequence. THREE, PrEx [prex-2609-00579] sharpens WHY the pack works and therefore what a pack should contain. FORGE reasoned that no frontier model has NishiLang in weights so verified facts beat parameters; PrEx measures that models do not apply semantics handed to them at all and are WORST under KeywordSwap and KeywordObf, exactly our case of C-like symbols with different meanings. So a pack lifts by supplying VERIFIED EXEMPLARS TO IMITATE, not by teaching rules, and every future pack rung should weight exemplars and live signatures ABOVE prose rules. The FORGE emitter already does this by construction, which is why it worked.
2026-09-06	LN	measure	THE LANG LADDER IS DELIBERATELY NOT DECLARED, AND THE REASON IS A MEMBERSHIP DISCREPANCY THAT MUST BE RESOLVED FIRST. nx_compare_rank reports rungs=82 for this board. A literal count over this file gives 82 occurrences of the string rung-pipe but only 81 whose id begins with L, and nx_txtscan matches case-insensitively so that is not a case artifact; probes for rung-pipe followed by E, C, D, T, N or F each return zero. So exactly one counted rung either has an id I cannot enumerate, or one occurrence of the string sits in PROSE inside a note and is being counted as a row. THOSE TWO POSSIBILITIES HAVE OPPOSITE REMEDIES AND I CANNOT YET TELL THEM APART, WHICH IS PRECISELY WHY NOTHING WAS DECLARED. A LADDER IS ALL-OR-NOTHING: NO-LADDER is merely LABELED and ranking proceeds, while PARTIAL makes nx_compare_rank REFUSE with exit 6. Declaring two sotatargets and 81 rungroles would therefore leave unplaced=1 and take the estate's largest language board out of ranking entirely, trading a harmless labelled state for a broken one, and if the second possibility is true the board could NEVER be completed because the missing rung does not exist to be placed. THE CHEAP EXPERIMENT THAT SETTLES IT, for whoever picks this up: enumerate the rung ids the ranker itself parses and diff that list against the 81 enumerated here (LB0-LB6, LN1-LN65 including LN13a and the LN board anchor, LR1-LR7); if the ranker's extra entry has no id, its row parser is counting a prose occurrence and that is a defect in the ranker rather than a gap in this plan. The formats board was safe to ladder in one atomic append precisely because its nine rungs were authored in this session and their membership was known exactly.
2026-09-06	LN	land	THE LANG LADDER IS DECLARED AND THE BOARD READS LADDERED: targets=2 rungs=82 placed=82 unplaced=0 badrole=0 badtarget=0 orphans=0 sum=82 with substrate 47, arm 16 and contender 19 summing exactly, alongside BARFRESH bars=5 fresh=5 malformed=0 verdict=FRESH. THE BLOCKER WAS A MEMBERSHIP QUESTION AND REFUSING TO GUESS IT IS WHAT MADE THIS SAFE. The ranker reported 82 rungs while a literal count found 82 occurrences of the row marker but only 81 whose id begins with L; probes for E, C, D, T, N, F, M, W and a leading-space prose mention all returned zero, and the per-group counts (LB 7, LR 7, LN1x 12, LN2x 11, LN3x 11, LN4x 11, LN5x 11, LN6x 7, LN7, LN8, LN9, the board anchor) summed to exactly 81, which proved the missing row was real rather than a miscount. It is rung
2026-09-10	autodev	release	2026-09-10 API-first toolchain delivery: live nx_fileop prepare-install-intent creates immutable checksum-bound plans and accepts identical replay without publication; native15/15 plus guarded ship contentGREEN/behaviorIDENTICAL. Live management daemon c07bc53f exposes /api/v2/promote_toolchain with host-pinned candidate/qualification, durable outcome, target lock and rollback; canonical signed-route13/13 and live wrong-intent refusal verified. Explicit toolchain-v2 registry rows refuse legacy deploy with VERSIONED_OPERATION_REQUIRED. Health initially reported restart transition down, then overallOK; running-executable identity independently matches. Configured runner candidate b947a767 and both intents prepared, RUNNER NOT YET PROMOTED; two other distinct runner copies unchanged. Full receipt knowledge/gates/toolchain-route-live-release-20260910.json. OOM handling, cross-target cohort, automatic journal reconciliation and full-model task savings remain unqualified.
2026-09-17	LN66	queue	Declared from the search R0s-b lane (2026-09-17): __q8blk_i16dot shipped x86-only (toolchain b4310ac4, canary GREEN, equiv 10/10 + selfhost + feature on both hosts); nx_compile_wat and the rv64 emitter carry no OP_I16DOT or OP_Q8BLKDOT case (only nx_ir.nx, nx_types.nx and nx_x86_64_ctx.nx name the ops), so nx_nofloat_q4k.nx and every engine source composing the builtins are x86-only until this rung lands; recipe: add the two cases to the wat emitter beside the OP_ATOMIC lowerings, a scalar case to the rv64 emitter, extend the equiv gate's feature leg with a per-door run, bite the wat case by deleting it and requiring a named refusal
2026-09-17	LN66	land	BOARD UN-REFUSED: nx_compare_rank had refused the whole lang board rc=7 (GRAPH malformed=9 missing_deps=1) because nine rung rows authored 2026-09-03 (LN36 LN37 LN38 LN39 LN40 LN41 LN42 LN45 LN46) carried 5 fields where the graph ruler expects 8, and LN49 depends on LN46; each row received its three missing fields (kind Organ, NOMINAL units 1 with LN42 at 2, deps LN38 on LN37 and LN41 on LN33, the rest none) by anchored edits whose predicted final size 233,728 B matched to the byte (seven rows were CRLF-terminated, two LF); the units are a nominal schema repair the lang seat may re-price; a one-call publish plan boardship-lang was seeded (rank, scoped regen, page verify) so this board ships the way search does
2026-09-22	LN67	land	2026-09-22 the operator's standing order landed as data: goal row rewritten, sotabar sb-lang-rivals (Rust 1.98.1, GCC 16.2, Go 1.27.1, Zig 0.16.0, read from mirrored pages), target lt-superior (WIN on every rival axis by the scorecard, alone on the sovereign axes), rungs LN67 scorecard and LN68 rival bars, and the first ten design rows: the choices already made to keep the human side from erring, each with the error class it prevents, its source kind, its evidence and its measured effect or UNMEASURED
2026-09-22	LN67	lesson	Superior is not a slogan and not a clone: it is a per-axis WIN against a named rival version, plus the axes nobody else has. The board carries the design choices as rows so the reason for each is read, not recalled, and the emitter renders the same ledger for every domain (ecosystem EC66)
2026-09-22	LN67	measure	2026-09-22 first render of the design ledger on this page (ecosystem EC66 landed): rows 10 = adopted 7 + proposed 3 + retracted 0 + refused 0 + malformed 0, unmeasured claims 2, evidence tokens 17 with 0 dead (LR1 and LR2 resolve as rung ids on this plan, not reference keys), verdict CLEAN; the emitted page carries 10 design rows and no raw design row text; page grew 852735 to 858712 bytes, the table
2026-09-22	LN69	lesson	2026-09-22 the modes were built as data on 2026-09-01 and measured on 2026-09-01; the choice between them has been a seat's hand ever since, which is exactly the one-size-fits-all the operator refuses wearing a mode's name
2026-09-22	LN67	land	2026-09-22 nx_lang_scorecard (ls_scorecard: one WIN, LOSE, TIE or UNMEASURED per rival per axis from lang.sota grades on the B > Y > ~ > n ladder and the lang.bench medians for the speed axis, default build and f1 mode each a row; SUPERIOR only when every rival axis is a WIN; rival cells dated by the new @cellsasof line of lang.sota, 2026-07) built sovereign; its gate reads 29/32 on the first run with all three reds in the fixture's own arithmetic (two n-vs-n ties, not one); the first real run read UNREADABLE because the qualify lane anchors CWD to buildroot and the organ spelled one tree -- rewired to nx_comparetree_lib before the first receipt is written
2026-09-22	LN7	retract	2026-09-22 the lang.sota speed prose still carries the 2026-08-14 finding as the ranked number-one perf rung (the backend not consuming its register allocation); LN7 LANDED 2026-08-23 and the 2026-09-01 receipt reflects it (default 7096 us vs gcc 2061, f1 4176 = 2.03x gcc, level with Go 4154 and ahead of checked Rust 4335). The next speed rungs are the ones after it: the remaining per-iteration instruction count in f1 mode against gcc's loop, read from the emitted assembly, then vectorisation (clang 1103 us shows the ceiling on this loop)
2026-09-22	LN67	measure	2026-09-22 FIRST SCORECARD RECEIPT (nx_lang_scorecard, gate 32/32 GREEN, artefact knowledge/compare/lang.scorecard in the published tree): rivals 11, axes 35, rows 396 = win 118 + lose 131 + tie 98 + unmeasured 49, superior=NO. Per rival (win, lose, tie, unmeasured): Rust 8 17 8 3; Zig 9 7 15 5; Go 10 17 6 3; Swift 9 14 8 5; Kotlin 9 13 9 5; TypeScript 11 11 9 5; Python 14 9 8 5; C 20 3 10 3; Elm 10 12 9 5; OCaml 9 14 8 5; Haskell 9 14 8 5. The speed axis from the receipt: default build LOSE to C (7096 vs 2061 us), Rust (4335) and Go (4154); f1 mode WIN over Rust checked (4176 vs 4335) and LOSE to Go by 22 us (4176 vs 4154) and to C. Rival cells are dated 2026-07 (@cellsasof), so every WIN is a win at the July versions until LN68 refreshes the cells to the September bars. The 131 LOSE rows are the language's work order and the ranker reads them through the rival columns
2026-09-22	LN67	queue	2026-09-22 nx_lang_scorecard is BUILT at buildroot/_build and deliberately NOT promoted this pass: its representative run exits 1 by design (NOT-SUPERIOR is the honest verdict) and the ship loop's behaviour qualification reads a non-zero exit as a failed probe; owed: a report verb that exits 0 for probing while the verdict verb keeps its exit code, then nx_organ_ship, register, and a scorecard render pass in the emitter (the .scorecard file beside .bench, one reader) so the per-rival table is on the lang page
2026-09-22	LN69	measure	2026-09-22 RESEARCH READ (six sources fetched through the sovereign fetcher, pinned, read from the mirrored bytes): the field separates WHAT a program computes from HOW it runs along four seams -- the schedule (Halide), the mapping (Legion), the scheduler (OCaml 5 effect handlers), and the serial reading every parallel form is verified against (OpenCilk; Exo-GPU this month) -- and MLIR makes the target itself a lowering table. NishiLang has none of the four seams today: parallelism is a library call, the loop shape is the source, control flow has no continuation, placement is where the code runs, and the doors are hard-coded. The modes as data (2026-09-01) were the first seam and they select flags, not shapes
2026-09-22	LN69	queue	2026-09-22 order of climb: LN70 first (the sequential meaning is the oracle every other shape is verified against, and the estate's determinism checksum makes the verification free), then LN71 (the schedule as data over the head-to-head loop is the fastest measurable win), LN74 (energy on the receipt before anyone claims energy), LN72 and LN73 (handlers and mapper), LN75 (doors). Each lands with a receipt on one checksum and a gate that plants the forbidden shape
2026-09-22	LN76	measure	2026-09-22 RESEARCH READ (five sources fetched sovereignly, pinned, read from the mirrored bytes): the field's answer to scattered tools is extension from within -- comptime (Zig), syntax elaborated in the language (Racket, Lean), one language for numerics (Julia), and this month an embedded language with its own proof mode written in Lean through Lean's metaprogramming. NishiLang has no compile-time execution, no syntax extension, no proposition in the language, a scatter of math organs with no language reaching them, and no count of the foreign programs its workflows still fork
2026-09-22	LN76	queue	2026-09-22 order of climb: LN80 first (the add-on census is cheap and makes the scatter a falling number), LN76 (comptime is the substrate for everything else and its refusal of nondeterministic inputs is the determinism guarantee), LN77, LN78 (the mathematician's stack over the estate's existing math organs), LN79 last (the frontier)
2026-09-22	LN81	lesson	2026-09-22 the whole-stack instance the estate already holds is the proof of the principle: a compiler builtin shaped to the model's block layout (search R0s-b) beat every layer-local optimisation because the layers were designed together in one language; a stack assembled from separate tools cannot make that move, which is the second reason the scatter of add-ons is refused
2026-09-22	LN67	queue	2026-09-22 COORDINATION CONTRACT (operator: get the work going along with the language work as they make logical sense together). Owners: the RACI row LANG-superiority-program; the ritual plan-lang-board-hygiene- runs before any rung is touched; the playbook names the loop. The crew's first three language rungs in order: LN80 the zero add-on census (cheap, and it feeds both the autodev mining lane and the lifecycle ruler, ecosystem EC71), LN70 serial elision verified by the compiler (the oracle every fluid shape is checked against), LN74 energy on the receipt (before anyone claims energy). Every language rung that supersedes an organ (LN78 unifying the math organs, LN71 replacing hand loop shapes) files lifecycle rows for what it supersedes the same hour, with the successor named, and leaves no parallel tool: the language climb and the lifecycle discipline are one motion. The scorecard receipt is re-run after every landed rung and its LOSE count is the number the crew reports
2026-09-22	LN80	land	2026-09-22 THE ZERO ADD-ON CENSUS, first cut: nx_lang_addons_lib la_addon_census (the estate root DERIVED from the registry's own first nx_ executable, never typed; every executable outside it named with its row; partition rows = estate + foreign + malformed + blank printed) with nx_lang_addons (CLI, registry resolved through the estate's declared root and the absolute path printed) and nx_lang_addons_gate 15/15 GREEN (planted add-on named, clean registry silent, rootless registry UNREADABLE never CLEAN, neg-control bite-proven). Built sovereign, NOT promoted this pass: its honest exit on a registry with findings is 1 and the ship probe wants 0 (the same report-verb-for-probing queue as the scorecard)
2026-09-22	LN80	measure	2026-09-22 FIRST RECEIPT on the serving-root registry /volume1/homes/elderwesto/nishihost/tool_allowlist.conf: rows 2125 = estate 2114 + foreign 2 + malformed 0 + blank-or-comment 9 (sum 2125), root derived /volume1/homes/elderwesto/nishihost/. The two rows named are nx_security_census and nx_conn_catalog, registered with executables under /var/services/homes/elderwesto/nishihost/_offc/, the same home under a second mount spelling: not a foreign program, a second spelling of the estate root, which every scanner reads as a different root. So the registry surface carries ZERO foreign programs today and two alias-rooted rows their owners should re-register under the canonical root; the ruler is right to name them and cut 2 classifies an alias as ALIAS-ROOT by directory identity rather than by text
2026-09-22	LN80	queue	2026-09-22 cut 2, named not hidden: the clock DESIRED plane, the gate roster, every plan plane (at least 296 plan manifests seen before the 20 s scan budget: a floor, not a total) and the pinned-args column, where a foreign program can hide behind an estate wrapper; an ALIAS-ROOT class by directory identity; a journal row per run so the number is a trend; the report verb that exits 0 so the ship probe qualifies; then promote, register and roster
2026-09-22	LN67	land	2026-09-22 nx_lang_scorecard SHIPPED sha 039a192fdc0acc39351c1156e229cb6c4fa7a8b4ad0c925bbdcfcd28a05d0b9f through nx_organ_ship (gate 32/32 rebuilt in the loop, first-time organ so no incumbent to lose), REGISTERED callable, gate on the roster, clock row langscorecard 86400 ./nx_lang_scorecard.elf put so the per-rival receipt is re-derived daily and its LOSE count is a trend; the ls_scorecard contract flips on the next lang regen; still owed: the .scorecard reader in the emitter so the table renders on this page
2026-09-22	LN80	land	2026-09-22 nx_lang_addons SHIPPED sha d28e61e07e70a9c17fdc208583c07e56a39d2cfdb81903dda4e0727934a24158 through nx_organ_ship (gate 15/15 rebuilt in the loop), REGISTERED callable, gate on the roster, clock row langaddons 86400 ./nx_lang_addons.elf put so the add-on count on the registry surface is a daily number; the la_addon_census contract flips on the next lang regen
2026-09-22	LN67	measure	2026-09-22 LIVE PAGE WITNESS after the scoped regen (SCOPE-FILE domain=lang, forkchecked 4 forkfresh 4, published 3, verdict GREEN; nx_page_verify GREEN a11y 0): the ls_scorecard cell reads measured present (ls_scorecard exists in runtime/nx_lang_scorecard.nx, verified at emit) with the state registered-unauthorised, and the la_addon_census cell reads exceed (source present, verified at emit) with the state lib-uncensused. Both residual states are rituals, not defects: registered-unauthorised clears when nx_toolreg_reconcile runs and a cap names the verb; lib-uncensused clears when nx_eco_graph_build then nx_importcensus re-run so the importers table sees the new lib (the recipe on the datavis board). The scoped regen raced on the shared scope file for the THIRD time today (a sibling wrote cms between two of this seat's writes; a run republished cms before the lang run): EC67 stands as the remedy, no workaround taken
2026-09-22	LN81	queue	2026-09-22 RESEARCH LEADS from the operator, the mechanical-sympathy school (UNREAD: cite nothing until fetched, read and pinned in lang.refs): Muratori, Clean Code Horrible Performance and the reXdev work (layers of abstraction, runtimes and compiler paths making software thousands of times slower than the silicon allows: the measured argument for LD18 whole-stack co-design and for the whole-system receipts LN81); Dan Luu's empirical latency work (input latency, file-system and terminal rendering measured against hardware floors: the instrument shape the browser and NishiOS boards need); Martin Thompson, Mechanical Sympathy and the LMAX Disruptor (cache-line alignment, false sharing, the single-writer principle, lock-free rings: candidate design rows for the language -- data layout that respects the cache as a default, a single-writer discipline the type system can check, no hidden allocation in a hot path). Each becomes a design row with its error class and a rung with a receipt on one checksum only after the source is read; the fluid-shape ladder (LN70 to LN75) is where the cache and single-writer rows attach
2026-09-22	LN81	queue	2026-09-22 the language rungs placed on the estate's seam map (ecosystem EC72): seam 1 silicon to microarchitecture is LN74 energy and the integer lane (LD1) with the block-native builtins (LN66); seam 2 microarchitecture to OS is the cache-respecting layout and single-writer rows the mechanical-sympathy leads will ground, attached to LN71 and LN73; seam 3 OS to runtime is the one-language ladder LN76 to LN80 (zero foreign crossings by construction, the add-on census as the ruler); seam 4 runtime to application is LD2 typed arrays, no hidden allocation and LD18; seam 5 application is the whole-system receipt LN81 and the seat's tokens per closed rung. Every rung above now names the seam it heals so the hub can render the climb in real time
2026-09-22	LN67	measure	2026-09-22 shipping the scorecard section into nx_swcompare_matrix: the content ruler named two lost runs, both one diagnostic string, the seg-store refusal SS-COMMIT REFUSED segid (seq1730) NOTHING WRITTEN, which the live generator (built earlier tonight) carries and the candidate does not. Attribution before approval: buildroot/runtime/nx_seg_store.nx no longer contains that string (count 0 over 259249 bytes), so a sibling lane reworded or removed the refusal upstream after the live build and the candidate correctly lacks it; the loss is not this rung's change and was approved by its exact token only after that read. The scorecard section itself only GAINS runs
2026-09-22	LN75	queue	2026-09-22 a fourth door named from the electronics frontier (ecosystem EC74): the hardware description of the estate's own core as a lowering dialect of the same source, beside x86-64, RISC-V 64 and wasm; and the DSSoC idea of a runtime routing work across heterogeneous cores without recompiling is LN69 mode fit plus LN73 mapper with the silicon as one more container. Both are placed on the ladder before any source is read; every claim about them waits for the read
2026-09-22	LN67	lesson	2026-09-22 an approved loss token is bound to the EXACT candidate artifact, and the second ship of the matrix generator produced a different candidate sha with the same two lost runs (evidence 4546 bytes, identical LOST lines): the closure had moved under a concurrent seat between the two builds, so the first token no longer named the artifact and the loop correctly asked again. Re-approved by the new token after re-reading the record; the rule holds: read the LOST lines every time, never carry a token across builds
2026-09-22	LN67	land	the scorecard section is PUBLISHED: nx_swcompare_matrix 04c61be8 shipped on attempt 6 (loss token re-issued three times as sibling edits to nx-shell and nx_compare_garden_lib moved the closure; the two lost runs were always the upstream SS-COMMIT REFUSED strings; the lang behaviour probe was accepted by the loop), buildroot/_offc twin refreshed and hash-verified 04c61be8, scoped regen GREEN forkfresh=4 published=3, /compare/lang carries id=scorecard and api.json carries scorecard rows=396 win=118 lose=131 tie=98 unmeasured=49 superior=0 rivals=11 cells_asof=2026-07, nx_page_verify GREEN 200 a11y 0
2026-09-26	LN	measure	2026-09-26 THE BOARD READ BEFORE ANY ROW WAS ADDED: nx_compare_rank lang read 98 rungs (45 done, 53 open, 19 with no matrix row), target version 2.0 at M3, critical path LN13 closures (a DARK-CONTRACT: the organ exists and the symbol is undeclared), then LN70 serial elision, LN46, LN69 mode fit, LN72 effect handlers, LN76 compile-time execution; nx_barfresh lang 8 of 8 bars FRESH for 2026-09; nx_ladder lang LADDERED 98 of 98 over 5 dated targets; the scorecard receipt of 2026-09-22 stands at 396 rows, win 118, lose 131, tie 98, unmeasured 49, superior NO, with the safety ring (every mode PART because it defaults OFF) and speed (default 7105 us against C 2079, Rust 4445, Go 4163; f1 4189 beats checked Rust and loses to Go and C) the two LOSE clusters
2026-09-26	LN	measure	2026-09-26 THE CURRENT MONTH READ, not recalled: the cs.PL listing (100 entries, 2026-08-27 to 2026-09-24, counted by the estate digester on the pinned bytes), the cs.MS and cs.SC listing (60, to 2026-09-23) and the quantum and photonic listing (60, to 2026-09-18) were fetched through nx_research_fetch, pinned, and read entry by entry; the rival versions were read from mirrored release pages (Julia 1.13.0 on 2026-09-10, Lean 4.34.1 on 2026-09-24, Mojo 1.1.0 on 2026-09-17, R 4.6.1 on 2026-06-24, MoonBit's September 2026 hackathon page); DARPA's page is a script-driven shell and its RSS feed carried this month's 10 opportunities; the Kaggle competitions page answered with a bot challenge and was REJECTED as a mirror, the kernel image Dockerfile was mirrored instead; the EU CRA page names 11 September 2026 as the reporting-obligation date
2026-09-26	LN	lesson	2026-09-26 A SEAT DIGESTED THE LISTINGS WITH A LAPTOP SCRIPT BECAUSE THE ESTATE HAD A CENSUS BUT NO READER: nx_arxiv_census proves a window is a population and nx_search_emerge extracts the month, and nothing turned the pinned bytes into rows a person or crew organ can read, so the read happened outside the estate -- the add-on LN80 exists to count. LN96 closes it in the language (nx_arxiv_digest with a bite-proven gate); the census stays the completeness ruler and the digest never claims it
2026-09-26	LN	queue	2026-09-26 THE CRITICAL PATH THE RANKER OWNS, NOT THIS SEAT: LN13 closures is a DARK-CONTRACT and its remedy is one edit (repoint the rung and its row to the real entry point, or name the function parse_closure_capture); the domain, door and arena rungs above rank by the ranker's own arithmetic on the next run, and the three targets are refused as LADDER-PARTIAL if any rung loses its role; the Kaggle competitions page and the Cangjie release page are still to be mirrored, and a Mathematica column waits on a mirrored version page before it is graded
2026-09-26	LN96	land	2026-09-26 nx_arxiv_digest SHIPPED through nx_organ_ship (sha 834c18ec4d7be7240a072d444a49c493cd7d0c2961b450adbc5bdeebe7bfea63, promoted, _offc twin installed, registered callable) with its gate rebuilt in the loop and then shipped itself (nx_arxiv_digest_gate sha 9f7734a6b9d10e57e8bbec416762d938915c28f86fe9a16d4e8a8288578cc1e9, 27/27 on the NAS build and 29/29 through the ship loop where the real listing is reachable, the non-feed neg-control bite-proven, registered, on the gate roster and on lang.gates); first live run over the pinned September cs.PL listing through the sovereign surface: entries=100 newest=2026-09-24 oldest=2026-08-27 rows_bytes=28006 at abstract_cap 160, verdict DIGESTED, population left to nx_arxiv_census by construction
2026-09-26	LN	retract	2026-09-26 THE COUNT 97 WAS WRONG AND THE ESTATE ORGAN CAUGHT IT: the barscan row, the ref cite and the measure row first said 97 entries from 2026-08-28, a number produced by a laptop script that reassembled the mirrored listing from line windows and dropped three entries at window seams (229,729 of 233,437 bytes reassembled); the shipped digester read the pinned bytes whole and counted 100 entries from 2026-08-27; all three sites were corrected the same hour. The add-on the zero add-on ratchet exists to count was also the instrument that miscounted, which is the whole argument for LN96
2026-09-26	LN90	land	2026-09-26 nx_lang_scorecard SHIPPED c5d885d825337ff61b08cae7a5fd88cfca7dd92054b32f8b0af8b55f8f5cd4d0 (nx_lang_scorecard_gate 41/41 with the category teeth; content ruler GREEN, behaviour DIFFERS by design because CATEGORY lines were added, adopt-gate APPROVED); category counts are sized from the board's own @cat lines and written as hash-prefixed cat rows the page reader skips by construction. FIRST RECEIPT with the three specialist columns and the Domain reach category: 14 rivals, 50 axes, 714 rows = win 226 + lose 212 + tie 212 + unmeasured 64, superior NO; per category Domain reach win 68 lose 47 tie 95 (210 rows), Sovereignty and determinism win 61 lose 1 tie 8, Memory safety win 12 lose 72 tie 14 (still the largest LOSE cluster), Tooling ring win 37 lose 41 tie 34; per specialist Julia 15W 17L 14T, R 18W 11L 17T, Lean 14W 21L 11T; the page's scorecard block re-derived rows=714 rivals=14 from the receipt on the same regen
2026-09-26	LN	measure	2026-09-26 THE BOARD AFTER THIS LEG: nx_barfresh 11 bars 11 FRESH; nx_ladder 8 targets (1 best-in-class, 7 frontier) 113 rungs placed 113; nx_compare_rank 113 rungs done 47 open 66 with the critical path unchanged at LN13 closures (DARK-CONTRACT, one edit away), then LN70 serial elision, LN69 mode fit, LN72 effect handlers, LN73 mapper, LN76 compile-time execution, LN46, LN75 doors, LN77 syntax extension, with LN78 the mathematician's stack at 15 and LN92 the quantum door at 16; the scoped regen published api.json 376,706 B (prev 326,481) and index.html 1,089,453 B (prev 945,866) with forkfresh 1 of 1 and verdict GREEN; the fleet refs gate read 38/44 RED on other domains' rows (graphics and procgen pins, uncited keys in authz, deploy, dataio and civicmap) with zero lang offenders across the 28 new pinned rows
2026-09-26	LN	queue	2026-09-26 OWED AND NAMED: the page reader nx_scorecard_receipt_lib skips the hash-prefixed cat rows and does not yet render a per-category table (LN90 follow-on: teach the ONE reader the cat row, then render); the Kaggle competitions page answered with a bot challenge and the Cangjie release page is not yet mirrored (SB-LANG-ARENAS names both); a Mathematica column waits on a mirrored version page; LN82's first suite (Charlwood's 50) is a data file to author from the mirrored paper before any domain rung claims a number; every new rung ranks by the ranker's arithmetic and none was hand-placed
2026-09-26	LN	land	2026-09-26 wave 13 SEAT TOOLCHAIN: THE opt_reassoc SHARED-CONSTANT FOLD IS FIXED IN THE PROMOTED COMPILER (debt 1790438934). The fold now lands in a fresh ir_const_i64 carrying the operand type (nx_opt.nx sha ac4fe062, 181227 B); a --no-cache rebuild of nx_compile_x86 was byte-identical to the 08:44 candidate (6d71ae5d, 989752 B), nx_cc_equiv_gate on it read rows 10/10 selfhost PASS kat PASS GREEN (job 1790454342), and the canaried POST /api/promote_toolchain moved buildroot/_offc/nx_cc_sovereign.elf 0b10f429 to 6d71ae5d with canary GREEN and 0b10f429 banked as .prev (a stale 989568 B nx_cc_sovereign.elf.new left from an earlier promote was overwritten first, or the promote would have installed it); the serving root nx_compile_x86.elf was promoted to the same bytes and nx_filehash cmp reads identical=1, so the two roots are one file; nx_ccfold_repro built by the production builder --no-cache reads defect_wrong=0 of 2 shape_wrong=0 of 8 control_wrong=0 of 2 verdict=CLEAN exit 0 (job 1790454716), the pointer probe of the RSA site reading 202
2026-09-26	LN	land	2026-09-26 THE COMPILER GATE NOW CARRIES THE FIXTURE AS A KNOWN-ANSWER STAGE: nx_cc_equiv_gate builds runtime/_hdl_build/nx_ccfold_repro.nx with the CHALLENGER by direct compiler exec (never the build cache, whose hit reuses an artifact without running the compiler under test), requires exit 0, prints the fixture's own probe counts on a CC-EQUIV kat line and decodes exit 1 (the compiler miscompiled a known answer) from exit 3 (a fixture control read wrong); the summary line gains kat=. Bite on the pre-fix compiler (_offc .prev ef649d20): rows 10/10 PASS, selfhost PASS, kat exit=1 defect_wrong=2 of 2 shape_wrong=7 of 8 control_wrong=0 of 2, gate RED (job 1790454494); on the fix GREEN. Shipped through nx_organ_ship against a release-flavour fixed challenger (the gate refuses a challenger byte-identical to the baseline): f405c97d promoted, _offc twin installed; the two lost runs were the base-class symbol names gv_cat and gv_catn (allow_loss_v1 ce5eb908) and the behaviour change (epoch header plus three additive report items) was reviewed (allow_behavior_v1 5793c92c)
2026-09-26	LN	measure	2026-09-26 AFFECTED ORGANS REBUILT ON THE FIXED COMPILER (nx_sov_build_run --qualify, fresh builds, nothing promoted by the qualify runs): gates nx_procgen_scene_gate 4/4 GREEN, nx_cloud_volume_gate 16/16 GREEN, nx_clock_edf_gate 11/11 GREEN, nx_gamefeel_oracle_gate 17/17 GREEN; nx_zero_claude_ledger_gate SKIP (the staged model gguf precondition is missing on this host, 0 checks run); nx_vcodec_t8noise_gate RED on a fixture precondition (cannot read yuv from the buildroot CWD); nx_worldgen_gate stopped at the 180 s qualify deadline. The four held crypto organs were rebuilt: nx_rsa_pkcs1_sign, nx_x509_emit and nx_authenticode_sign selftests each ran out the 540 s deadline while generating the deterministic 2048-bit test modulus (end-to-end UNOBSERVED; the fixture's pointer probe of the rsa site reads 202 on the fixed compiler), and nx_efivars_enrol was rebuilt build-only, never run and never promoted (never-brick). None of the four is promoted. Superseding debt 1790457142 carries the rest (ships of the shipped sites, a keygen-free crypto KAT or a longer deadline, the census re-run which needs its listfile); 1790438934 EATEN
2026-09-26	LN	land	2026-09-26 ROLL-OUT OF THE FIXED COMPILER INTO SHIPPED SITES, AND THE CONTROLS: nx_procgen_scene_gate re-shipped through nx_organ_ship (e87bf184, 4/4 GREEN, behaviour IDENTICAL; the three lost runs were base-class symbol names sys_openat_append, gv_cat, gv_catn, allow_loss_v1 00b754ef) and nx_cloud_volume_gate re-shipped (058e14c7, 16/16 GREEN, same three symbol names, allow_loss_v1 b94f2527); nx_compile_wat, which links nx_opt.nx, was re-shipped 6ea4c2ef so the wasm lane carries the fold fix too. NOT shipped, with the reason: nx_gamefeel_oracle_gate (the SERVED binary is RED 0/1 because it reads an absolute buildroot/knowledge/gamefeel_oracle.conf that does not exist, the current source reads it and the candidate is 17/17 GREEN, but the ship loop refuses a behaviour comparison against a live run that did not succeed); nx_clock_edf_gate (the candidate drops real clock-library strings -- SS-COMMIT REFUSED, STS-LOCK open-failed, clk_merge_store MALFORMED/REPERIOD/RETARGET -- from the clock sources' own evolution, a loss for that owner to adjudicate; its site is latent). Census re-run over the wave 10 list (job 1790457902): listed=22299 read=22297 unread=2 functions=206209 const_locals=13448 hits=49 locals_observable=35 locals_latent=8 files_with_hits=34 coverage_complete=0 (wave 10: 47 hits, 34 observable, 7 latent, 33 files; none of this wave's edited files carries a hit) -- the source shapes stay, and they are harmless once rebuilt by the fixed compiler. VM regression control: nx_wasm_popcnt_gate rebuilt on the fixed compiler and the new VM, run against the promoted nx_compile_wat, 119/119 GREEN
2026-09-26	LN	measure	2026-09-26 nx_worldgen_gate rebuilt on the fixed compiler reads 4/4 GREEN given a 600 s deadline (job 1790457676; it had stopped at the 180 s qualify deadline earlier), so the nx_worldgen library with its GI-path site builds and passes on the fixed compiler; it and nx_gen are not re-shipped (the gate needs about eight minutes, longer than the ship loop's prove window was tested for). Wave 13 debt state for this defect: 1790438934 and the interim 1790457142 EATEN, the final state carried by 1790458186 (sev 4)
2026-09-26	LN95	land	nx_door_census_lib + nx_door_census + nx_door_census_gate shipped through nx_organ_ship (gate 27/27, neg-control bite-proven, recursion-guarded), promoted fed5ffdd, registered, _offc twin installed; the ladder is data at buildroot/knowledge/lang_doors.conf (9 doors: x86-64, wasm32, rv64, wasm64, mcu, gpu, quantum, photonic, cluster)
2026-09-26	LN95	measure	first true ladder receipt 2026-09-26 (nx_door_census over runtime/nx_bounds_perf.nx): x86-64 PASS checksum=31447040000 through nx_compile_x86 then nxasm_x86_main then the built ELF run in place (3 of 3 stages); wasm32 REFUSED at stage 1 of 3, nx_compile_wat rc=3 with no arm in the WAT emitter for an opcode the fixture uses; rv64 REFUSED by name, ./nx_compile_rv64.elf is not on the host; wasm64, mcu, gpu, quantum, photonic and cluster ABSENT (declared with no lowering); doors=9 pass=1 refused=2 absent=6, partition sums, verdict MEASURED
2026-09-26	LN95	lesson	two receipts before the true one were the instrument, not the doors: the merged stdout+stderr capture glued the compiler's one log line onto the .s and the ASSEMBLER refused it (fixed by tr_run_redirect for artifact stages: stdout is the product, stderr the tail), and the NAS mounts /tmp noexec so the built fixture read NX-EXEC-FAILED rc=127 (fixed by a scratch ladder that starts at buildroot/_build/door_census and prints the rung it took); a REFUSED door must be read as a claim about the pipeline until the plumbing is proven innocent
2026-09-26	LN95	queue	the wasm32 door is the next lowering: read buildroot/_build/door_census/door_w32.wat.err for the opcode nx_compile_wat has no arm for on this fixture, add the arm or lower the construct, then the VM twin must echo the checksum before the door can read PASS; the rv64 driver is LN34's door; tr_run_redirect carries no deadline so a hanging compiler hangs the census at that stage (a deadline variant is owed)
2026-09-26	LN82	lesson	/api/promote read nx_domain_kat as an ORACLE BY ITS NAME (ma_name_is_oracle keys on the _gate, _test and _kat suffixes and never consults organ_kind.conf, as that file's own header records) and refused D001 for a runner that is not a gate; declared oneshot in organ_kind.conf and promoted with allow_own_verdict=yes, named here and not hidden; a classifier that consults ma_kind is the residue on the mgmt API's RACI lane
2026-09-26	LN82	land	nx_domain_kat_lib + nx_domain_kat + nx_domain_kat_gate shipped: gate 31/31 GREEN through nx_organ_ship (the first cut forked itself with an empty argv, a sentinel written into the splitter's cursor, and ran the whole referee in every child; fixed by a flag-driven scan and a recursion guard on every referee that forks its own binary), organ promoted 60c1840a, registered on the tool surface; the first suite is knowledge/bench/domain_kat/math.kat (6 reachable exact-multiplication rows with CPython products, 10 Charlwood integrals as unreachable rows)
2026-09-26	LN82	measure	first receipt 2026-09-26 (nx_domain_kat math.kat): rows=16 pass=3 fail=3 unreachable=10 reachable=6, verdict RED; the three FAILs are one finding: nx_mathcore mul answers MATHCORE-REFUSED operand-is-not-an-unsigned-decimal for 18446744073709551615, 12345678901234567890 and 9876543210987654321, so the exact-arithmetic organ's decimal door stops below 2^64 while its product is 128-bit; the pairs (0,0), (2^32,2^32) and (1000000007,998244353) pass with the oracle's product byte for byte
2026-09-26	LN82	land	nx_mathcore decimal door widened to the whole u64 range (limb-wise parse, a decimal wider than 64 bits refused BY NAME as exceeds-64-bits): nx_mathcore_gate 31/31, shipped through nx_organ_ship with the three lost runs enumerated and approved by their exact token (two refusal literals now composed from parts, the retired mc_put64 symbol name) and a representative live-vs-staged probe IDENTICAL on mul 1000000007 998244353; promoted e77b6206, _offc twin installed
2026-09-26	LN82	measure	second receipt 2026-09-26 (nx_domain_kat math.kat, after the widening): rows=16 pass=6 fail=0 unreachable=10 reachable=6, verdict MEASURED; every reachable product matches the CPython oracle byte for byte, including (2^64-1)^2 = fffffffffffffffe0000000000000001 and 12345678901234567890 x 9876543210987654321; the ten Charlwood integrals stay UNREACHABLE, which is the honest distance to lt-every-domain on the mathematician's axis until LN83 lands a notation and an integrator that accepts it [charlwood-full-2609-25616]
2026-09-26	LN90	land	nx_langcensus gains mode=<name> (forwarded to the compiler as --mode=<name> BEFORE the path) and root=<dir>, and its first gate nx_langcensus_gate (23/23: a planted root, the gate as the planted compiler, three runs, DELTA and the REGRESSION exit bite-proven); promoted 8c6eec67 after the one lost run (the sys_execve_clean identifier string) was read and named
2026-09-26	LN90	queue	the checked-mode whole-population census is IN FLIGHT as job 1790462580 (nx_langcensus /volume1/homes/elderwesto/nishihost/nx_compile_x86.elf knowledge/status/langcensus_checked_20260926.rows 60000 mode=checked root=buildroot): rows append as each program is decided, so the file is a PREFIX until the job's envelope prints LANGCENSUS verdict=; read the envelope from _jobs/job_1790462580.out and journal the refusal histogram here as the measured distance to flipping the safety ring on by default (the 2026-09-03 default-build figure was 773 refusals)
2026-09-26	LN90	lesson	the in-flight checked-mode census (job 1790462580) classifies correctly but its REASON column is void: under --mode= the driver prints an INFO line (nx_compile_x86: --mode= conf resolved at knowledge/lang_modes.conf) before any diagnostic, the census's marker list accepts the driver prefix as a diagnostic marker (added 2026-09-03 so driver refusals would not read as blank), and 974 of the first 975 ERR rows grouped under that line -- a histogram that names no cause; the OK/ERR/HANG classes and the refusal COUNT stay valid, the reasons do not; fixed at the root in nx_langcensus (an information line is skipped, never a reason), and a re-run under the fixed census is queued once the in-flight run publishes its envelope
2026-09-26	LN90	measure	prefix of the in-flight checked-mode rows read 2026-09-26 while the job ran (the first 163,840 bytes of the rows file, a PREFIX by construction): programs=2982 ok=2007 err=975 hang=0 harness=0; the population is the whole runtime/ walk (about 13,790 programs on 2026-09-03), so the checked-mode refusal share of this prefix is roughly one third, against 773 refusals in the default build that day; read the envelope in _jobs/job_1790462580.out for the population figure
2026-09-27	LN90	measure	checked-mode whole-population census COMPLETE 2026-09-26 (job 1790462580, nx_langcensus mode=checked root=buildroot, 60000 ms per program): files=22285 programs=15723 ok=6859 err=8864 hang=0 harness=0, partition RECONCILES, rows_written=1231788 at knowledge/status/langcensus_checked_20260926.rows; 564 permil of every top-level program refuses to build with chkarith, optenforce, ptrprov, ownership and sendcheck all ON, against 773 refusals in the default build of 2026-09-03 (a population of 13790 then, 15723 now) -- that is the measured distance to flipping the safety ring on by default, and it is a BASELINE (no judgement), not a regression
2026-09-27	LN90	queue	the reason histogram of job 1790462580 is VOID (8864 of 8864 grouped under the driver's --mode= info line, the defect fixed in nx_langcensus e8eb491c); the re-run under the fixed census is job 1790471555 writing knowledge/status/langcensus_checked_20260926b.rows with the first rows as its BASELINE, so its envelope doubles as a determinism control (delta new_err=0 new_hang=0 fixed=0 expected) and its REASON lines are the per-cause worklist for the safety ring; journal that histogram here and on the sota memory-safety rows when it lands
2026-09-27	LN95	measure	the wasm32 door's refusal, read from buildroot/_build/door_census/door_w32.wat.err: nx_wasm cannot lower IR opcode 29 in function fmt_putn_fd (the fixture's decimal printer); the backend has no arm for that opcode and refuses by name instead of emitting a comment that computes zero (its own header records that older silent form); the wasm32 door opens when that one arm lands in the WAT emitter and the VM twin echoes the checksum
2026-09-27	LN90	measure	prefix of the corrected checked-mode census (job 1790471555, the first 1723 programs, a PREFIX by construction): ok=1407 err=315, and the reasons now name causes: 295 of 315 refusals are --optenforce (a dereference of a pointer the mode cannot prove non-null on its path, grouped by local name: ctx, c, lp, a, p, out, slot), chkarith=0 ptrprov=0 ownership=0 sendcheck=0 other=20; so the null-enforcement mode is the ring's dominant blocker on this prefix and its proof rules (which idioms count as a null check) are the first lever, read the job's REASON histogram when it completes before sizing the campaign
2026-09-27	LN90	measure	corrected checked-mode census COMPLETE (job 1790471555, nx_langcensus e8eb491c, baseline = the first run's rows): files=22305 programs=15739 ok=6859 err=8880 hang=0 harness=0 RECONCILES, rows at knowledge/status/langcensus_checked_20260926b.rows; delta against the first run new_err=0 new_hang=0 fixed=0, so the census is deterministic and the 16 extra programs are files added to the tree between the runs; the reasons now name causes: --optenforce 8330 of 8817 counted refusals (the null-enforcement mode; the local 'ctx' alone 3603, then c 523, p 368, lp 316, out 287, fresh 278, b 247, h 232), --ownership 210, constant-arithmetic overflow 70 (chkarith's compile-time check), and REASON-TABLE FILLED at 512 distinct reasons so the histogram is a PREFIX of 8880 (63 uncounted); the null rule is 94 percent of the distance to the safety ring
2026-09-27	LN90	lesson	the locals the null mode cannot prove are overwhelmingly PARAMETERS named by convention (ctx, c, p, lp, out, a, b, h, st, w, src, slot): the estate trusts internally (rule 12) and never null-checks a parameter, so a checker that treats every pointer parameter as maybe-null refuses the estate's own idiom more than 8000 times; the SOTA convention is the opposite default, a pointer parameter non-null BY TYPE with nullability declared where null can arise, which moves the proof to the call site and the fallible producer; landed as design LD22 and rung LN97 (contender on lt-typed-security), a compiler-lane change through the canaried toolchain door, not a threshold
2026-09-27	LN95	land	nx_door_census v3 shipped through the full loop with a REVIEWED behaviour change (review file knowledge/status/harness/door-census-review-20260926.txt bound to the retained observation, evidence file beside it): artifact stages run through tr_run_redirect_to (a bounded redirect runner added to nx_tool_run, the incumbent watchdog composed, no polling interval invented), a stage that outlives the deadline is HANG (killed, named with the deadline; gate 34/34 with a planted hanging stage and a wall-clock tooth proving the kill), promoted d9093af6; the RV64 door is DECLARED on the ladder: nx_nxc (the original sovereign RV64 driver, promoted from its build fossil ea7ef711) then nx_emu_rv64_main (promoted 6a27e72b)
2026-09-27	LN95	measure	ladder receipt 2026-09-26 run 6: x86-64 PASS checksum=31447040000; wasm32 REFUSED at stage 1 of 3 (nx_compile_wat: no arm for IR opcode 29 OP_ADDR_OF, the address of a stack array in fmt_putn_fd); rv64 REFUSED at stage 1 of 2 with the first stage NAMED: nx_nxc expands and compiles the whole closure to 184677 bytes of RV64 assembly and its assembler stops at pos 34814 (n_labels=121) on an atomic mnemonic with the .aqrl suffix -- nxasm_v2 (RV64I+M) does not carry the RV64A forms nx_riscv emits for OP_ATOMIC_* (LN34); 6 doors ABSENT; doors=9 pass=1 refused=2 hang=0 absent=6, partition sums, verdict MEASURED
2026-09-27	LN95	queue	the two doors now have ONE named blocker each: wasm32 needs a shadow stack for address-taken and array allocas in the WAT backend (OP_ADDR_OF arm, frame allocas as real pointers, prologue and epilogue at the one exit label) and then a host write import so the checksum can surface in the VM twin; rv64 needs RV64A (lr, sc, amo* with aq and rl bits) in nxasm_v2 and, behind it, in nx_rv64_sim if the emulator lacks them
2026-09-27	LN95	land	the RV64 door's assembler blocker is gone: nxasm_v2 carries RV64A (lr, sc, amoswap, amoadd, amoxor, amoand, amoor, amomin, amomax, amominu, amomaxu over .w and .d with the .aq, .rl and .aqrl bits) and FENCE (pred and succ over i o r w), encoded from the ISA manual's A extension; nx_nxc rebuilt with it assembles the fixture's whole 185,326-byte closure (stage 1 of the rv64 door PASSES on the staged driver) and is promoted 46d6f5cd; the emulator stage now answers exit 254 with no output, the next named blocker
2026-09-27	LN95	measure	the staged WAT backend with the shadow stack (frame allocas as real pointers, OP_ADDR_OF as the slot's address, helpers built from block and br_table only) COMPILES the fixture (stage 1 PASS on the staged compiler) and the sovereign WAT compiler assembles the 24,552-byte module (stage 2 PASS); stage 3 is nx_wasm_vm_verify, which abstains (exit 3, NOT-A-RENDERER) on a plain program, so the browser door now needs a runner that calls main and a host write import so the checksum can surface -- the door row keeps its honest REFUSED until that runner exists
2026-09-27	LN95	measure	THREE DOORS PASS THE SAME FIXTURE 2026-09-26 (nx_door_census run 8 on runtime/nx_door_probe.nx, checksum 686096800 computed outside the estate by CPython): x86-64 PASS (nx_compile_x86, nxasm_x86_main, run in place), wasm32 PASS (nx_compile_wat --host-write with the shadow stack, nx_wat_compiler, nx_wasm_run calling main on the VM twin with env.nx_write bound to the host's stdout: the checksum surfaced from a wasm module for the first time), rv64 PASS (nx_nxc with RV64A in its assembler, the RV64 emulator with fence, RV64A, mmap and a named step budget); doors=9 pass=3 refused=0 hang=0 absent=6, partition sums, verdict MEASURED; the six absent doors (wasm64, mcu, gpu, quantum, photonic, cluster) are the ladder's remaining distance
2026-09-27	LN95	land	the browser door's pieces: nx_wasm.nx carries a shadow stack for address-taken and array allocas (frame slots as real pointers, OP_ADDR_OF as the slot's address, helpers built from block and br_table only, the stack pointer in a cell past the static data because neither the WAT compiler nor the VM twin carries globals, a module with no such alloca byte-identical, a shared-memory module with one REFUSED by name) and the host write door behind nx_compile_wat --host-write (env.nx_write, opt-in so shipped modules stay byte-identical); nx_wasm_vm binds env.nx_write to the host's stdout and stderr with bounds traps; nx_wasm_run <module> [export] runs an export on the VM twin and prints WASM-RUN export= rc= last; the RV64 door's pieces: nxasm_v2 RV64A + fence, nx_emu_rv64 fence, RV64A, mmap bump allocator, unknown syscalls answer -ENOSYS, nx_emu_rv64 <elf> [max_steps] with every non-exit outcome NAMED on stderr (the old exit 254 was the step budget as a bare byte); the door fixture is runtime/nx_door_probe.nx and the h2h bench fixture stays the speed fixture
2026-09-27	LN95	lesson	a door blocked at its last stage by a bare status byte cost a diagnosis the emulator could have printed: exit 254 was the step budget, not a fault, and the fixture (the h2h bench, billions of instructions) was the wrong program to ask an interpreter to run inside a 60 s deadline; a door fixture measures that the door carries a program end to end, the bench fixture measures speed, and the two must not share a row; and the estate ALREADY held the RV64 driver (nx_nxc, built and never promoted) and the VM's host-import dispatch (a sibling landed it the same day for the device client) -- ★★★★★★ "I DIDN'T KNOW IT EXISTED" IS A RETRIEVAL FAILURE, NOT A DISCOVERY, paid twice in one leg
2026-09-27	LN95	measure	the promoted WAT compiler (1ea9e8f8) against its referees, 2026-09-26: nx_wat_refuse_gate 14/14 GREEN (LN13a intact: a function address still refuses as IR opcode 144) once its subject default was a root ladder instead of a bare _build/ path that does not exist from the serving root (fixed and promoted 038a9015; it had read PRECONDITION MISSING with six dependent FAILs for a reason unrelated to any compiler); nx_wasm_threads_gate 33/37 RED, ADJUDICATED PRE-EXISTING: nx_behaveprobe live-vs-prev on its own fixtures fx_shared.nx and fx_plain.nx reads IDENTICAL (11507 and 1332 bytes, first_diff_off=-1, STRONG) and the roster journal shows the same 33/37 on its last eight rostered runs before this promote -- its four failing teeth are the shared-memory limits declaration (min 1 max 2) and belong to the GE30 build-lane memory work, named here for that lane; nx_world_recipe_gate 18/18 GREEN; nx_wasm_run_gate 16/16 GREEN (the new runner, end to end on the promoted toolchain); nx_game_page_artifact_gate exits 2 (usage) under a bare gate_run, unrelated
2026-09-27	LN95	queue	the ladder's remaining distance is the six ABSENT doors -- wasm64 (LN35), mcu (LN91), gpu (LN75), quantum (LN92), photonic (LN93), cluster (LN94) -- each opens by adding its stages to buildroot/knowledge/lang_doors.conf and reading PASS on nx_door_probe; the browser HOST must bind env.nx_write (console) in the page loaders before a --host-write module can run in a page (the VM twin binds it today); nx_door_census's CLI default fixture is being moved to nx_door_probe so the roster beat needs no argv; the shared-memory shadow stack (a per-thread pointer) is the named refusal for threaded modules with address-taken allocas
2026-09-27	LN95	land	2026-09-27 nx_door_census SHIPPED c2336215: the CLI default fixture is runtime/nx_door_probe.nx, so the bare run reads x86-64 PASS, wasm32 PASS, rv64 PASS, 6 ABSENT, verdict MEASURED; shipped through the loss protocol (2 lost runs, both the old default path literals, allow_loss_v1) and the behaviour-review protocol (review sha eec6c075, retained observation dc0dc236); gate 34/34 GREEN on the NAS; _offc twin installed; /compare/lang republished (published=3 fails=0 forkfresh=1), nx_page_verify GREEN, nx_compare_rank lang BARFRESH 11/11 FRESH and LADDER 114/114 LADDERED
2026-09-27	LN95	measure	2026-09-27 nx_compare_rank lang critical path: #1 LN13 capturing closures at 2.0, #2 LN70 serial elision, #3 LN69 mode fit UNMAPPED; 20 of the 33 ranked rungs read DARK-CONTRACT, which for an unbuilt symbol on an existing organ file is the ruler's honest reading (sd_present 0 = organ read, symbol not declared), not a naming defect; 3 rungs UNMAPPED (LN69, LN46, LN61: no matrix row carries the symbol); TREATMENT rows=0 undeclared=114 verdict NO-TREATMENT (EC49 three-step treatment not yet declared on this board)
2026-09-27	LN95	queue	the six ABSENT doors stay ABSENT by name in the census (wasm64 LN35 is the nearest: nx_wasm.nx already centralises the i32 narrowing behind wat_mem64_on; the WAT compiler's limits encoding and the VM's i64 addressing are the missing stages); the mechanism owed for the darkness axis is unchanged: a matrix row per rung symbol (LN69, LN46, LN61) and treat rows for the rungs that already have MCP, API, primitive, workflow and agent evidence
2026-09-27	LN35	land	2026-09-27 the wasm64 door is built and shipped, sovereign end to end (every receipt reads nx_cc->nxasm_x86, no gcc): nx_wasm.nx wasm_memory64 decides the index type ONCE from the driver flag --memory64 or a module static nx_wasm_memory64_req = 1 (the board's contract symbol, so the LN35 cell stops reading dark), wat_addr_const emits address constants in the index type, the page ceiling follows the index type, the mmap helper grows in i64 and fails with -1; nx_wasm_data.nx emits i64.const data offsets under wd_idx64; nx_compile_wat parses --memory64; nx_wat_compiler encodes limits flag 0x04 (4/5/7) through wc_mem_flags and wc_mem_atom and accepts i64.const segment offsets; nx_wasm_vm carries mem_idx64, a u64 LEB reader, the 2^48-page ceiling, an i64 grow delta with a -1 failure and the i64.const segment check; nx_wasm_run_gate grew tool ladders and eleven memory64 teeth (28/28). SHIPPED: nx_wasm_run 5a3ca7b5, nx_wat_compiler 092e791b (3 lost runs = its reworded data refusals, probe IDENTICAL STRONG on the real WAT), nx_compile_wat 0792cdc4 (4 lost runs = the four indentation-prefixed i32.const literals now emitted through wat_addr_const; behaviour reviewed: the WAT differs from the live binary by ONE extra SSA local in the first function, a parser-closure change -- nx_parse.nx mtime 1790522705 is newer than the live build 1790480590 -- not a lowering change), nx_wasm_vm_verify 1ce8f560, nx_wasm_vm_memgrow_gate 539e36bc (21/21 on the new VM), nx_wasm_run_gate 0d412154; lang_doors.conf row wasm64 is DECLARED with its three stages; nx_wat_refuse_gate 14/14 on the new emitter; nx_wasm_threads_gate unchanged at its pre-existing 33/37 (the same four shared-memory limits teeth, GE30)
2026-09-27	LN35	measure	2026-09-27 nx_door_census job 1790541519 (default fixture buildroot/runtime/nx_door_probe.nx, promoted binaries): x86-64 PASS 3/3, wasm32 PASS 3/3, rv64 PASS 2/2, wasm64 PASS 3/3 (checksum=686096800 through env.nx_write on the VM twin under the i64 index type), mcu gpu quantum photonic cluster ABSENT; doors=9 declared=4 pass=4 fail=0 runs_unmeasured=0 refused=0; the sota cell "Native backends in one shipped toolchain" moves from 3 to 4 doors
2026-09-27	LN35	queue	the LN35 done-rule is met on the sovereign VM twin and NOT yet on a browser: (1) a module past 65536 pages instantiating in a memory64 browser over the CDP wire (the oracle stays outside the build path; the page loader must bind env.nx_write and env.nx_getrandom first), (2) a declared MAX on unshared memories (the emitter emits MIN only under both index types today), (3) memory64 with a shared memory (refused by name: the shared data init and the per-thread stack are 32-bit), (4) memory64 tables (tables stay 32-bit in the VM); the five ABSENT doors keep their rungs (LN91 mcu, LN75 gpu, LN92 quantum, LN93 photonic, LN94 cluster)
2026-09-27	LN95	measure	2026-09-27 the door ladder reads 4 of 9 doors PASS on one fixture (x86-64, wasm32, rv64, wasm64), up from 3 the same morning; every stage forks an estate binary built by nx_cc and nxasm_x86 (the receipts say no gcc), the only outside parties are oracles: CPython computed the fixture checksum once and a browser is the queued witness for the 4 GiB crossing
2026-09-27	LN13	land	2026-09-27 CAPTURING CLOSURES (LN13c) on the native and RV64 doors, sovereign end to end: nx_parse.nx parse_closure_capture (the board's contract symbol) lowers a function literal that reads enclosing names into a compiler-emitted environment from the module's own sys_mmap (slot 0 the code address, slot k+1 the captured value) BY VALUE; the literal's value is TY_CLOSURE (nx_types.nx, kind 14, pointee = return type); a call through it (postfix or direct-local) loads slot 0 and passes the environment as the hidden first argument through the existing call_indirect; inside the lifted function every captured name is an address-backed local aliasing its slot, so a counter persists across the closure's own calls and the enclosing variable never moves, and the subscript-read and address-of paths learned that an environment slot does not auto-load like an alloca (the one defect the first run found: a captured pointer read as the slot's address); an unannotated let inherits TY_CLOSURE; refused by name: struct or stack-array captures, statics, a func(...) annotation over a closure, an unprovable capture set, more than 22 arguments. Front ends shipped with the new parser: nx_compile_x86 c18411d5 (plain promote, 8 lost runs = the superseded LN13b refusal strings), nx_nxc 811bd674 and nx_compile_wat 0dd60fc3 (ship loop, behaviour IDENTICAL on the door probe), the gate nx_closure_capture_gate 67b0e86e 19/19 (by-value copy, pointer write-through, two captures beside a parameter, the non-capturing control, wasm refusal by name, two planted refusals); nx_cc_equiv_gate with the new compiler as challenger: rows 10/10, selfhost GREEN, KAT GREEN
2026-09-27	LN13	measure	2026-09-27 nx_door_census on the PROMOTED ladder with runtime/nx_closure_probe.nx: x86-64 PASS and rv64 PASS (tick=1,2,3 outer=0 mk=42 dbl=42 checksum=686096800 computed THROUGH a pointer-capturing closure), wasm32 and wasm64 REFUSED by name (WAT VALUE: function addresses require table lowering -- the LN13a table rung), five doors ABSENT; the control fixture nx_door_probe.nx still reads 4 of 4 PASS on the same promoted binaries, so the parser change is neutral for programs without closures (the door-probe WAT is byte-identical live versus staged, 403442 bytes)
2026-09-27	LN13	queue	the build-lane compiler _offc/nx_cc_sovereign.elf still carries the pre-closure parser (the canaried /api/promote_toolchain lane names nx_cc_sovereign, nxasm_x86_main and nx_sov_build_run; the staged compiler is nx_compile_x86 c18411d5 and has to be offered to that lane under the toolchain name) -- until it lands, organs built by nx_sov_build_run cannot use closures while programs built through the door compilers can; the wasm door needs the call_indirect table lowering (LN13a) before closures cross it; capture by reference or move (LN4 owns the moved-value refusal), closures in func(...)-typed struct fields, closures on the wasm door and escape analysis stay open; the LN13b referee source runtime/nx_closure_gate.nx (never built) asserts that a capture is REFUSED and is superseded by nx_closure_capture_gate: retire that tooth or fold its two probes into the capture gate
2026-09-28	LN13	land	2026-09-28 the BUILD-LANE compiler carries closures: buildroot/_offc/nx_cc_sovereign.elf promoted through /api/promote_toolchain (target nx_cc_sovereign.elf, staged as nx_cc_sovereign.elf.new from the promoted door compiler c18411d5 through nx_filecopy under organ_run, provenance ledger first sighting, ELF floor, .prev banked by the lane, nx_tc_canary GREEN); the outgoing toolchain 03ff3ddb (894090 B) is banked hash-verified at knowledge/status/harness/nx_cc_sovereign.elf.bank-20260928 beside the lane's .prev; nx_cc_equiv_gate had read 10/10 rows, selfhost GREEN and KAT GREEN with this compiler as challenger before the promote; organs built by nx_sov_build_run can now use capturing closures
2026-09-28	LN13	queue	organs that embed nx_parse.nx and were promoted before 2026-09-27 (the census, the formatter, the language server, the incremental cache) still carry the pre-closure parser until their next ship; the LN13b source-only referee runtime/nx_closure_gate.nx keeps a capture-is-refused tooth that LN13c supersedes; the wasm doors wait on the call_indirect table lowering (LN13a)
2026-09-28	LN23	land	2026-09-28 ENERGY PER RUN ON THE RECEIPT: nx_lang_h2h h2_energy_arm (the board's contract symbol) composes the estate's own nx_energy_probe (source detection: powercap RAPL, a discharging battery, else UNMEASURABLE) around every arm's timed runs and hands the result to the ONE receipt writer, which emits an energy row (arm, uj_per_run, source, note) right after the arm row; nx_bench_receipt_lib grew two stride slots (BR_A_EUJ, BR_A_ESRC), the energy branch in br_parse (a row attaches to the arm it names among the arms parsed so far, a row naming no arm attaches nowhere), the writer rows and br_energy_note; old receipts read exactly as before (no energy source = 0); the probe gained ep_class_word; nx_lang_h2h_gate grew a fixture round trip (attach by name, -1 UNMEASURABLE by name, writer-to-reader identity, a row naming no arm) and live teeth behind a gv_need for an energy-aware receipt. The receipt was regenerated on the laptop (asof 1790602594, 9 arms VALID, ratio unchanged, the WSL2 host has no powercap and its battery reads Not charging) and pushed to the compare tree at 7671 bytes
2026-09-28	LN23	measure	2026-09-28 lang.bench: 9 of 9 arms carry an energy row; 9 of 9 read -1 UNMEASURABLE with the reason named (no powercap, no discharging battery; a cycle count is a speed proxy, not joules); the timing columns are unchanged in method (c-clang-O2 reference median 1130 us, nishilang-f1 4239 us, nishilang-default 7204 us on this run); no VALID energy column exists yet because no host in the estate exposes a package energy counter today (NAS: /sys/class/powercap absent; laptop WSL2: absent)
2026-09-28	LN23	queue	the first VALID energy column needs a host that exposes powercap RAPL or runs the bench on battery (the laptop on battery would read PSU); the /compare renderer (bench_pass in nx_swcompare_lib) does not yet draw the energy row -- the receipt carries it, the page does not, and that column is the next data-to-page step; the cycle-counter proxy (nx_energy_model fJ per cycle) is deliberately NOT written as joules on this receipt (LN74 owns the modelled axis)
2026-09-28	LN19	land	SHIPPED 2026-09-28: opt_vec_reduce (nx_opt.nx) rewrites the counted accumulate loop (LOAD local < bound header; MUL or SHL scale; GEP or ADD address; one element load; one accumulate ADD; one increment; two stores) into one OP_I64SUM (nx_types 155, ir_emit_i64sum) with n = hi - k and the counter landed on the bound; x86ctx_emit_i64sum lowers it to four two-lane SSE2 accumulators (movdqu, paddq) with an unsigned block count (shrq, andq) and a scalar tail; the switch is per door (nx_compile_x86 sets X86_SSE2_I64_LANES, --no-vecred is the A/B lever, the driver prints nx_vecred lanes=); every refusal is counted and printed per function (VECRED r_bound r_body r_escape r_elem r_shape r_preds). Door compiler PROMOTED 304d0f5d (1020048 B) with its _offc twin refreshed, nx_vecred_gate 43/43 GREEN on the NAS (promoted ed905570) and on the laptop, nx_cc_equiv_gate 10 rows plus self-host plus the constant-fold KAT GREEN on both hosts; the build lane goes through promote_toolchain in the next row
2026-09-28	LN19	measure	the head-to-head accumulate loop (20480000 element reads, checksum 31447040000) on the laptop WSL host: candidate f1 981 us against 4168 us with --no-vecred and 4181 us on the pre-change toolchain; gcc -O2 2075 us and clang -O2 1098 us on the same box (lang.bench 2026-09-28); the done-rule asked for within 1.2x of gcc -O2 and the measured ratio is 0.47x of gcc, within 0.9x of clang; the receipt is re-measured by the promoted compiler in the receipt row below
2026-09-28	LN19	lesson	A DISTRIBUTION TOOTH IS NOT A KNOWN ANSWER: the fixture prints beside every packed sum a scalar reference computed by a loop the pass cannot touch (it walks the index down) and the gate re-derives the closed forms from the fixture's constants, so a wrong lowering cannot read equal. A fixed array under a RUNTIME bound keeps its bounds check inside the loop (the guard proves nothing about the length), so that shape is the elision's to refuse and the reduction sees a multi-block body. A loop the optimizer proves never runs is swept before it is lowered (eight rewrites reported, seven lowerings emitted), so the gate asserts the paddq count against the emitted lowerings, never against the rewrite count. The laptop's buildroot fossil of the compiler was a Sep-4 binary: the gate takes its subject on argv and prints resolved_by= so a green is never a green about a fossil
2026-09-28	LN19	queue	LN19a the RV64 and wasm lowerings of OP_I64SUM; LN19b the AVX2 four-lane door by measured CPUID as a ladder row; LN19c the surface builtin __i64_sum(p, n); LN19d the sibling reductions (product, min, max, xor, i32 elements) through the one matcher; the head-to-head receipt gains the vectorized arm on the next run
2026-09-28	LN19	land	BUILD LANE PROMOTED 2026-09-28: nx_cc_sovereign.elf 304d0f5d (1020048 B, the same bytes as the door compiler) through /api/promote_toolchain, canary GREEN, previous banked by the door and separately at knowledge/status/harness/nx_cc_sovereign.elf.bank-20260928b (997200 B, the LN13c build); every organ built from here on carries the reduction vectorizer, switched on for the native door
2026-09-28	LN98	queue	M9 declared 2026-09-28 from six mirrored sources (the LLVM testing and test-suite guides, the Fujitsu suite README, the cpplinks compilers index, the K2 story, the August 2026 arXiv listing) and the operator's order; standing today: every class ABSENT on the matrix, the estate's only suite-class instruments being the 10-row equivalence net, the self-host gauntlet, the door census, the gates and their bites
2026-09-28	LN19	measure	RECEIPT RE-MEASURED 2026-09-28 by the LN19 compiler (the laptop-lane build d0304a3e of the promoted source; the content door serves sources and knowledge, not promoted binaries, so the NAS bytes 304d0f5d are named, not run): lang.bench min of 7 on the laptop WSL host, checksum 31447040000 on all 9 arms VALID -- nishilang-f1 964 us, nishilang-drag 788 us, nishilang-default 7049 us (default mode keeps its checks in the loop and is not vectorized), checked 10512 us, daily 10509 us, against clang -O2 1092 us, gcc -O2 2055 us, go 4112 us, rustc checked 4316 us; the f1 mode is 2.13x faster than gcc and 1.13x faster than clang on this loop, drag 1.39x faster than clang; the done-rule (within 1.2x of gcc -O2) is met with a ratio of 0.47x. lang.leaderboard declared (EC80) with these rows as the h2h-accumulate board
2026-09-28	LN100	land	FIRST SLICE SHIPPED 2026-09-28, the first instrument of M9: nx_progen_lib (pg_generate: a well-defined NishiLang program from a seed -- i64 arithmetic that wraps, array indices masked into a power-of-two length, divisors (x & 15) + 1, counted loops to constant bounds, no recursion, helper functions, by-value closures and the LN19 reduction shape, every value folded into one checksum; self-contained with its own write syscall, number printer and anonymous mapping so it compiles from any directory and any door; a planted-mutation mode flips one constant), nx_progen (the CLI), nx_progen_diff_lib + nx_progen_diff (a=<cc> b=<cc> seeds= first= stmts= flag= bflag= mutate= ledger=: builds every seed through both compilers, assembles with the one assembler, runs both, compares bytes and exit codes, one ledger row per seed as decided, the partition last: agree disagree refused-a refused-b asmfail runfail-a runfail-b), nx_progen_gate 18/18 GREEN on the NAS (ba4270b9) and the laptop with the bite proven (the mutated twin reads DISAGREE on 4 of 4 seeds while the reduction switch-off reads AGREE on 12 of 12). Promoted nx_progen f1cbfaa1, nx_progen_diff 9e802737, registered on the MCP surface
2026-09-28	LN100	measure	CROSS-GENERATION DIFFERENTIAL on the NAS 2026-09-28: the banked previous build lane (nx_cc_sovereign.elf.bank-20260928b, the LN13c toolchain) against the promoted LN19 toolchain, 40 seeds from 200 under --bckelide: agree=40 disagree=0 refused=0 runfail=0, partition SUMS, verdict GREEN (ledger /tmp/ln100_xgen.ledger); the laptop's old _offc toolchain refuses every seed by name (REFUSED-A, it predates capturing closures), which is the comparator naming a generation gap rather than hiding it
2026-09-28	LN100	queue	the 10000-seed bar per candidate is unmeasured (40 today); the door mode (the same seed through rv64 and wasm) waits on LN19a and the door census; shape weights stay uniform until LN104 mines the bug corpora; the checked mode needs its own comparator (both sides must trap at the same statement); a disagreement has no reducer until LN106
2026-09-28	LN100	retract	THE 10000-SEED BAR IS RETRACTED 2026-09-28 (operator: isnt 10k a magic number): a typed count is a magic number, so the queue row of 1790608600 that named it is superseded by this row; the seed target is now DERIVED at run time by nx_progen_diff as numerator x population, where the rule of three [rule-of-three] says zero disagreements over n seeds bound the per-program miscompile rate below 3/n at 95 percent, so 3 x population keeps the expected number of miscompiled programs in the estate below one; the numerator, its confidence and the population dirs are rows of knowledge/progen.conf beside their calibration, the population is counted from the tree by one getdents64 loop per directory to exhaustion and deduplicated by basename (the two build trees hold the same names), and every generator shape knob (stmts, vars, funcs, arr, depth, trip_max) is a FIXTURE-CLASS conf row pending the LN104 mined distributions; a conf the generator cannot run on (a non-numeric row, a zero divisor, an array length that is not a power of two) is refused BY NAME and nothing runs
2026-09-28	LN100	measure	DERIVED TARGET MEASURED 2026-09-28 on the laptop tree: population=22132 distinct .nx basenames over the 4 conf dirs (43098 entries before dedupe, 0 absent), numerator 3 at 950 permil, target_seeds=66396, standing NO-LEDGER (the standing run has not been started; the comparator with no seeds= continues a ledger toward the target from one past its highest seed); nx_progen_gate 43/43 GREEN on the laptop against the LN19 compiler with 18 new teeth (the fixture conf applies its knobs, a non-power-of-two arr and a non-numeric stmts are refused BY NAME with the value left at the bootstrap, an absent conf leaves the bootstrap, a fixture population of 7 entries over two dirs plus one absent dir reads 6 distinct with the absent dir named, the target reads 3 x 6, the ledger census counts only mutate_b=0 rows and takes the max seed over every row, a zero-seed run is never green by vacuity); NAS numbers on the next measure row after the NAS build
2026-09-28	LN100	measure	DERIVED TARGET MEASURED ON THE NAS 2026-09-28: population=22497 distinct .nx basenames over the 4 conf dirs (22550 entries before dedupe, 0 absent; the NAS build tree and its twin hold near-identical name sets, so dedupe by basename is what keeps the count honest), numerator 3 at 950 permil, target_seeds=67491 (the laptop tree reads 22132 and 66396: the population is a property of the host that runs the comparator, printed on every run, never carried between hosts); nx_progen_gate 43/43 GREEN on the NAS by /api/gate_run (path FAST, subject buildroot/_build/nx_compile_x86.sov.elf by ladder; the live conf resolved at knowledge/progen.conf, the fixture conf, the two refusals by name, the population and ledger teeth, the 12-seed switch control and the 4-seed planted-mutation bite all green); promoted nx_progen_gate 4bd42e64, nx_progen_diff e1282c3a, nx_progen 206d4929 with _offc twins installed; knowledge/progen.conf landed at both roots; the standing ledger has 0 rows (standing NO-LEDGER) and starts with the next row
2026-09-28	LN100	measure	THE BEAT SLICE SHIPPED 2026-09-28 (the standing run is a beat, not a seat): nx_progen_diff takes interval_s=<beat seconds> and derives its own budget as the interval minus one worst-case seed (six bounded runs x the 120 s run timeout = 720 s, so a 30-minute beat runs seeds for 18 minutes and starts none past that; a 10-minute beat is refused by name as shorter than one worst-case seed), prints PROGEN-DIFF-SLICE interval_s= budget_ms= elapsed_ms= seeds_planned= seeds_run= stopped=BUDGET-or-DONE, and judges the partition over the seeds actually run; nx_progen_gate 45/45 GREEN on the NAS (two new teeth: the budget reads 18 minutes for a 30-minute beat in an independent unit, the short beat is refused) and the laptop; promoted nx_progen_gate 1d244b0a and nx_progen_diff d4b2fd62 with _offc twins; the NAS population re-read on this run is 22672 (68016 seeds), up from 22497 an hour earlier because other lanes landed sources -- the target follows the tree and is re-derived on every beat; eco graph and import census refreshed (22787 nodes, asof 1790637268) so LN100 leaves LIB-UNCENSUSED on the next publish
2026-09-28	LN100	queue	THE STANDING RUN IS DECLARED AS A CLOCK ROW 2026-09-28: progendiff every 1800 s = nx_progen_diff.elf a=nx_compile_x86.elf b=nx_compile_x86.elf interval_s=1800 ledger=knowledge/status/progen_x86_live.ledger flag=--bckelide bflag=--no-vecred srcdir=/tmp/progen_live execdir=buildroot/_build/progen_live (revision 221, DESIRED_COMMITTED; the scheduler folds it live at its next window init, about half an hour); every beat continues the ledger from one past its highest seed for at most 18 minutes, re-derives the target from the tree, and becomes a no-op reading AT-TARGET once the ledger holds numerator x population agreeing seeds; the witness that the beat fires is the ledger itself (ledger_rows and max_seed rising beat over beat, read by nx_progen_diff seeds=0), never the row's declaration; a DISAGREE row is a vectorizer miscompile with its seed as the reproducer and has no reducer until LN106; the door mode (the same seed through rv64 and wasm) still waits on LN19a, and the interval on the row and the interval_s in its argv are the same number in two fields of one row by construction of the clock grammar, named here so a later edit moves both
2026-09-28	LN100	lesson	A CLOCK ROW WITHOUT AN EXECUTABLE BINDING IS SCHEDULED AND STILL NEVER FIRES: nx_clockjob put landed progendiff on both planes (LIVE scheduled=1) with executable_binding=UNBOUND schedule_state=WAITING_AUTHORITY authority_reason=EXPECTED_EXECUTABLE_MISSING, so the declaration read as live while the dispatcher had no authority to run it; the second half is nx_clockjob bind <name> <revision> <interval> <sha256 of the promoted elf> <absolute command> (done 2026-09-28: revision 222, expected sha d4b2fd62 = the promoted nx_progen_diff.elf, schedule_state=ELIGIBLE authority_reason=BOUND_CONTRACT, next_due 1790639211), and every re-promote of nx_progen_diff must re-bind the row to the new digest or the beat stops with the binding as its reason; the witness stays the ledger (rows and max_seed rising), read by nx_progen_diff seeds=0 or nx_clockjob get progendiff execution_proven
2026-09-29	LN100	measure	THE /tmp OUTAGE OF 2026-09-29 WAS THIS ROW'S SCRATCH: nx_dirbytes (new census organ promoted 054baba3: allocated bytes by top-level entry and by name family, symlinks counted never followed, two counters of one population reconciled) read /tmp/progen_live at 7.8 GB in 236,721 files, three per seed, never deleted once a seed was judged; /tmp stood at 1000 permil with 0 B free, so every /api/build capture and every nx_job_run output under /tmp came back empty, and from seed 37,800 every generated program was written as 0 bytes (s53707.nx) and the A-side compile refused it: the 15,906 ledger rows for seeds 37,800-53,706 are REFUSED-A for programs that were never written, not compiler findings (debt 1790667949 by W19, which also stopped the row; 1790674394 carries the umbrella and the build-capture residual)
2026-09-29	LN100	land	THE DISK IS NOT THE COMPILER, PROMOTED 2026-09-29: nx_progen_diff 68587c96 (131,664 B) and nx_progen_gate 5d32bedc (161,256 B, 49/49 GREEN, registered the same hour, _offc twins installed). One naming (pd_seed_path, eight kinds) is shared by the writer and the reaper so they cannot disagree; a source write that lands short is IOFAIL (verdict 7), never REFUSED-A; a compile refusal while the source filesystem holds less room than the larger of the program and the largest agreeing seed's measured footprint is IOFAIL; an agreeing seed's scratch is unlinked the moment its row is in the ledger (keep=1 retains it) and every other verdict keeps its files as its reproducer; the loop stops before a seed when the room is at or under the measured footprint and on the first IOFAIL (stopped=DISK). nx_contentdiff live to staged lost 0 runs for both (differ gained 26, gate gained 17). The new reap verb (nx_progen_diff reap) reaped the backlog from the ledger: rows=53706 reaped_seeds=37798 kept_rows=15908 files_unlinked=264586 partition=SUMS; /tmp 1000 -> 587 permil with 7.8 GB free, /tmp/progen_live 7.8 GB -> 126,976 B; nx_progen_reap_gate fcb810de 22/22 GREEN plants all eight kinds across seven verdicts and a bystander file
2026-09-29	LN100	retract	A FIRST IOFAIL RULE WAS REFUTED BEFORE IT SHIPPED: an empty compiler error capture plus too little room was to mean the disk, but s39735_a.err, from a compile the full disk killed, held 4,340 B of the compiler's own status lines (crash-guard, dce, vecred, BCK-ELIDE), so an error capture is no evidence either way; the shipped rule is room against need only, and an IOFAIL seed keeps its files for inspection
2026-09-29	LN100	lesson	A DIFFERENTIAL TESTER THAT CANNOT TELL ITS DISK FROM ITS COMPILER FILES THE DISK AS COMPILER FINDINGS -- 15,906 of them here: the write result was never checked, so a full tmpfs produced empty programs and the A-side refusal of an empty file became the verdict; the check sits at the write (bytes written against bytes asked), the refusal is judged against the room the program needed, and the scratch a judged seed no longer needs leaves with its row, or the tester's own evidence becomes the next outage
2026-09-29	LN100	queue	progendiff STAYS STOPPED FOR ITS OWNERS (W19 stopped it at revision 222 -> 259, OWNER_STOPPED): the leak half of 1790667949 is closed in the path, but the serial-dispatcher hog 1790666328 (the row holds the one clock dispatcher up to 900 s of every 1800 s) is untouched and is the clock owner's and this lane's call. The recipe in 1790667949 binds the OLD digest d4b2fd62 and would now refuse; for the promoted binary it is nx_clockjob reactivate-bound progendiff 259 1800 68587c9651019016633829050442ca862263f575a2c953c371e2c9eb1877009a plus the unchanged absolute command. Owed before a long unattended run: the 15,906 false REFUSED-A rows are re-run or marked by the ledger's owner, and the remedy's second item (stop after a run of identical non-disk refusals, e.g. a broken A compiler, whose reproducers are kept by design and would refill /tmp at the seed rate until stopped=DISK) is not built -- IOFAIL covers the disk cause only; its bound is derived, the run length the ledger's own per-verdict rate makes implausible over the population, never a typed count
2026-09-30	LN107	queue	2026-09-30 operator scope is estate-wide; compiler and future IDE consume the same bottom-up contracts. Causal guidance and human/machine/AI usability are planned; no new diagnostic implementation or human study is claimed.
2026-10-01	LN107	land	THE BOARD WAS RANK-REFUSED FOR NINE HOURS BY TWO UNPLACED RUNGS (2026-10-01): LN107 and LN108 were declared on 2026-09-30 without rungrole rows, so nx_ladder lang read verdict=PARTIAL with REFUSAL-RULE RUNG-UNPLACED (placed 127 of 129) and nx_compare_rank refused the board with exit 6 for every lane. The cross-board lane appended two PROVISIONAL role rows (LN107 arm toward lt-peer-systems, LN108 contender toward lt-superior) so the queue ranks again; both are the lang lane's to re-adjudicate. Owed mechanism, named rather than patched here: a rung row landing without its role row should be refused or named at the write, not discovered by the next seat that ranks
2026-10-01	LN67	measure	BARFRESH 2026-10-01 (seat residue-fleet, T0 1790856940): before STALE with 12 of 12 bars UNATTESTED on the October clock. Page bars handled from bytes re-fetched and read this month: sb-lang-rivals RE-DATED 2026-09 to 2026-10 (releases.rs now lists Rust stable 1.99.0, the beta that was due 1 October; any scorecard row that names Rust 1.98.1 now names a superseded rival version, a re-measure this seat did not make) and SB-LANG-ARENAS ATTESTED at 2026-09 (DARPA opportunities feed, 10 items, newest pubDate 29 Sep 2026, none in October). Left for the arXiv attest runner and NOT fetched by this seat: the ten bars whose refs are keyed arxiv- (arxiv-msc-2026-09 and arxiv-qphot-2026-09 verified as export.arxiv.org urls, the other refs taken by key name): sb-weakmodel-code, sb-semantics-in-context, sb-slm-code-whitespace, sb-agent-accept, sb-lang-frontier, SB-LANG-FLUID, SB-LANG-ONELANG, SB-LANG-DOMAINS, SB-LANG-DOORS and SB-TESTING. The GCC, Go and Zig release pages were not re-read. The page needs a regen.
2026-10-03	LN20	measure	LN20 LOOP SPLITTING MEASURED 2026-10-03 on the laptop WSL host (Intel Core Ultra 7 255HX, 7 runs per arm, in-process microseconds, every arm printing checksum 31467520000): the wide-guard kernel runtime/nx_bounds_wide_perf.nx (a [1024]i64 summed 20000 times inside a loop whose guard runs to 2048 and whose body skips the access past the array) built by the compiler from BEFORE the rung reads f1 median 18724 us against clang -O2 6381, gcc -O2 7258, rustc -O with its bounds checks in play 7242 and go 9053, which is 2.93x clang; built by the compiler carrying bck_irce_split the same source reads f1 8825 us against clang 6416, gcc 7336, rustc 7291 and go 7865, which is 1.38x clang and 1.21x the checked rustc, a 2.12x speedup from the rung alone on the same host in the same hour; drag reads 8978; default 17660 (no elision by design); checked 24659 and daily 24548 are unchanged, because checked arithmetic puts an overflow branch between the counter's load and its store and the induction proof refuses the increment (r_iv_inc_unguarded), so those two modes keep the check on every read exactly as before. Receipts on the NAS: buildroot/knowledge/bench/lang_ln20_before.bench (sha256 0be4cf89) and lang_ln20.bench (sha256 64aa3b2c) with their confs lang_h2h_ln20_before.conf and lang_h2h_ln20.conf beside them and the rival arms in buildroot/bench/lang_h2h_wide; repro: nx_lang_h2h knowledge/bench/lang_h2h_ln20.conf from a host that carries gcc, clang, rustc and go (the NAS carries none, so the receipt names the laptop). A second differential: 400 generated programs (nx_progen_diff seeds 1 to 400), the compiler from before the rung without elision against the new compiler with --bckelide, 400 of 400 AGREE with the partition summing; the generator's loops are guarded at exactly the array length or masked, so none of the 400 reaches the splitter and that run proves only that the changed guard finder did not disturb the shapes it already handled
2026-10-03	LN20	land	LN20 LOOP SPLITTING SHIPPED 2026-10-03. bck_irce_split (buildroot/runtime/nx_bck_elide.nx sha256 db562eea) is run first by opt_bounds_check_elim (nx_opt.nx sha256 476b87fb): for a loop header ending BR_COND on LOAD(counter) <s L whose body holds a constant-length check site shorter than L indexed by that counter, the whole loop (the guard and every block reachable from its true edge without passing the guard) is cloned; the original becomes the MAIN loop with its bound tightened to the smallest covered length, so the induction pass then proves and elides its check; the clone becomes the POST loop with the original bound, its guard spelled mirrored (L >s counter) so no later round splits it again and no table of split loops exists to go stale; one loop per call, the next wide loop in the optimizer's next round. Method replicated: LLVM InductiveRangeCheckElimination [llvm-irce] (limit = smin(n, len), a check-free main loop, a post loop for the rest), built here for the CONSTANT-bound case and with no pre loop, because every counter this pass admits is proven non-negative by the induction theorem (the source's own no-first-segment case); the runtime-bound case and the pre loop are rungs LN20a and LN20b, named rather than implied. Refusals are named and tallied on stderr (BCK-IRCE cand= split= with r_irce_not_wider, r_irce_shape, r_irce_opcode, r_irce_pool, r_irce_outside): a second exit or a side entry; a guard block holding anything but the counter's load and the compare (the guard runs once more at the hand-over); an opcode whose operand slots are not all value ids, an alloca among them; a body-defined value used outside the loop; a pool that cannot hold the clone. The guard finder now accepts the mirrored spelling as a guard (the post loop's increment must be guarded for the induction proof) and never the counter-on-the-left form. Gate nx_bck_iv_gate 42 of 42 GREEN on the laptop twice and on the NAS against the NAS-built compiler: F2 traps 71 with exactly one split and an unchanged trap-site count across two bodies; F6 returns 88 from inside the main loop; F8 runs every one of 1024 post-loop iterations and returns 88; F10 prints LT then traps 71, so the trap is at exactly the first out-of-range index; F7 (a break) is refused by name with nothing cloned; F9 (counter > constant) keeps its check and traps. Bite: two source mutants each turned the gate RED at 34 of 39 (the counter-on-the-left misread, under which F9 died by signal on an unchecked read; the post loop made unreachable, under which F2 exited 0 and F8 exited 255), and the restored source rebuilt byte-identical. Sibling gates against the same candidate on the NAS: nx_bck_elide_gate 13 of 13, nx_vecred_gate 43 of 43, nx_cc_equiv_gate 10 rows plus self-host plus the fold KAT. Promoted: door compiler nx_compile_x86 69467e97 (1051096 B, no capability loss), nx_bck_iv_gate 373ef6fc under allow_capability_loss with all nine lost runs named from the complete inventory (seven teeth renamed or replaced by the split teeth, two allocator messages reworded upstream in nx_syscalls), build lane nx_cc_sovereign.elf through promote_toolchain with canary GREEN; the previous build-lane compiler is banked at knowledge/status/harness/nx_cc_sovereign.elf.bank-20261003 (304d0f5d, 1020048 B)
2026-10-03	LN20	lesson	A GATE HANDED A RELATIVE COMPILER PATH MEASURED A FOSSIL: cb_anchor_root moves the working directory into buildroot, so argv[1] = _build/nx_compile_x86.sov.elf silently became buildroot/_build/nx_compile_x86.sov.elf, on the laptop a month-old binary, and the first LN20 run read 18 of 20 with the pass apparently not firing while the compiler run by hand split the loop. The gate now joins a relative argv path to the caller's directory BEFORE the anchor and prints SUBJECT= with the path it really forks. The anchor had a second blind spot: the builder's --qualify runs the organ it just built from INSIDE buildroot, where the buildroot/ probe misses, so every anchoring gate read SKIP tree-not-found on the one lane that builds and runs without installing; cb_anchor_root (nx_ccbuild_lib.nx) now accepts the tree's own runtime/ as a second starting point with the first keeping precedence, proven by the same gate GREEN from both directories on both hosts. nx_vecred_gate carries serving-root-relative path constants instead of an anchor, so under --qualify 12 of its 43 teeth fail on a missing directory with every compiler-behaviour tooth passing; it was run through gate_run from the serving root, and its paths are owed the same anchor
2026-10-03	LN20	lesson	A SIZE TOOTH MEASURED TWO PASSES PULLING IN OPPOSITE DIRECTIONS: F1's the-assembly-is-strictly-smaller tooth has been RED against every compiler since LN19 on any run that named a subject (31795 B plain against 31979 B under the flag), because the flag that elides the check also adds the packed-add lowering; nobody saw it because the roster forks this gate bare and a gate with no compiler named reads SKIP. The tooth now builds F1 a third way (--bckelide --no-vecred through cb_build_flags2, one build sequence with cb_build_flag delegating to it) and compares that: 30796 B against 31795 B, with the same two trap sites removed. A gate whose every scheduled run is a SKIP is a comment: this one is owed a roster row that names its subject
2026-10-03	LN20	queue	WHAT LN20 DOES NOT DO, each a named row: (1) the runtime bound, while k < n with n a value the loop does not change, is the loop real programs write and the case the source's pass exists for; the split admits only a constant guard bound today: rung LN20a. (2) no pre loop: offset indexes, a counter that can start below zero and descending loops are refused by the induction theorem before the splitter is asked: rung LN20b. (3) the daily and checked modes gain nothing: checked arithmetic's overflow branch hides the counter's increment from the induction proof (r_iv_inc_unguarded, r_iv_load_not_local on the receipt kernel), so the elision and the split both stand down under the two modes that carry the most checks; teaching the proof to see through a checked add is its own rung, owed. (4) the opcode allowlist is narrower than the inliner's: a loop holding float, rotate or bit-count ops is refused r_irce_opcode; widening it needs each opcode's operand slots read off its emitter. (5) the guard-purity refusal has no fixture, because no source shape produces a guard block holding more than the counter's load and the compare today; it is a refusal that has never fired, named here so nobody counts it as proven. (6) the generator does not reach the splitter (LN100): its loops are guarded at exactly the array length or masked, so 400 of 400 agreeing seeds say nothing about a split; a wide-guard statement shape changes every seed's program, so it needs a generator version stamp on ledger rows first. (7) one split per optimizer round and at most eight rounds: a function with more than eight wide loops leaves the rest checked, counted nowhere yet. (8) the page renders one bench receipt per domain; the wide-guard receipts live under knowledge/bench and reach the page only through this log until the emitter renders several receipts. (9) nx_bck_iv_gate is forked bare by the roster and reads SKIP; it needs a row that names its subject. (10) nx_bck_elide_gate and nx_cc_equiv_gate were rebuilt on the NAS under --qualify for this verification and NOT promoted: their sources are unchanged and only the shared anchor probe in nx_ccbuild_lib differs, so the served gates stay as they were, deliberately
2026-10-03	LN109	measure	THE PUBLIC DEFECT RECORD READ BY CLASS, 2026-10-03, every source mirrored through nx_research_fetch and pinned on lang.refs. CISA KEV catalogVersion 2026.10.02 (1733 entries, 1733 cwes arrays, 249 dateAdded in 2026), tag occurrences counted by nx_txtscan over the mirror: CWE-78 110, CWE-787 105, CWE-416 93, CWE-119 87, CWE-843 38, CWE-122 33, CWE-125 17, CWE-190 16, CWE-362 12, CWE-400 5, CWE-476 1. MITRE 2025 Top 25 in list order: 79, 89, 352, 862, 787, 22, 416, 125, 78, 94, 120, 434, 476, 121, 502, 122, 863, 20, 284, 200, 306, 918, 77, 639, 770. Reading: the exploit record is memory corruption plus injection; the outage record (four vendor post-mortems read the same hour) is null and unhandled errors, an underived limit, a stale check and restarts with no backoff; null dereference is rank 13 on the weakness list with one exploited tag, so an exploit-only scoreboard would never rank the class that took two clouds down. Both records are kept
2026-10-03	LN109	land	MILESTONE M10 LANDED AS BOARD DATA 2026-10-03 under the operator's order of the same day: one dated bar (SB-HAZARDS, October 2026), a best-in-class and a frontier target, thirteen rungs LN109 to LN121 each with a role, eight design rows LD29 to LD36 whose prevented error class is the earlier language's flaw with its pinned evidence, thirteen matrix rows, nine axes rows for the scanner's seeds and ten pinned references. The six classes this board already carried (typed bounds, raw-pointer provenance, use after free, integer overflow, null, data races) keep their rows and rungs; M10 adds the classes no rival column closes. Nothing here is built: every new cell is a watch
2026-10-03	LN121	measure	THE ESTATE'S OWN ATTESTER RE-EARNED THIS BOARD'S BARS WITH NO SEAT READING FOR IT, 2026-10-03: nx_frontier_scan attest lang printed ATTEST-DONE bars=12 appended=1 already=9 unattestable=2 fetches=204 newer_sources=3 stale_bars=0 verdict=ATTESTED, and nx_compare_rank then read BARFRESH fresh=2 attested=10 stale=0 verdict=FRESH. The cost is the finding: 17 dated sources were asked about every bar and most are graphics and biomedical venues (SIGGRAPH and its Asia edition, Eurographics, CVPR, ECCV, IEEE VR, the kesen indices, Europe PMC), whose three NEWER verdicts were a radiography paper and two unrelated repositories. Sources are not scoped by board, which is LN121's first leg
2026-10-03	LN121	lesson	A LOOSE QUERY STALES A BAR ON HOMONYMS AND HIDES THE REAL ENTRIES AT THE SAME TIME. The testing bar's listing was the all-fields phrase compiler testing: its two September entries were a GPU physics benchmark and an agent runtime, so the attester read newest 2026-09 and the bar went stale on nothing, while a subject-tight listing (cs.SE or cs.PL with the testing phrases in the abstract) showed two genuine September entries the loose one never returned (Trivet, 147 of 148 LLVM transformations verified or refuted with the Lean kernel checking every verdict; Faultless, translation validation for neural decompilers). The query is the per-reference subject filter: it needs no organ change, and the attester re-earned the bar by itself the same hour. A board-wide category class cannot do this for a board whose bars span several subjects
2026-10-03	LN121	queue	WHAT STILL NEEDS A SEAT, NAMED. (1) Re-declaring a bar when a listing moves to a new month: the attester detects it and the ranker refuses, but reading the new entries and rewriting the bar is adjudication, and the estate's local engine cannot author it yet; a computed bar (the class counts LN109's census rewrites from the feed) removes the seat for the measurable half. (2) Admitting a proposal: the scanner proposes and never admits, by design. (3) Authoring the compiler passes behind LN110 to LN120. (4) Rendering the proposal rows on the page: the emitter shows the gauge today and has no reader for the proposal plane. (5) The sovereign TLS client cannot complete a handshake with blog.sigplan.org (a TLS 1.2 alert after a 1.3 hello it could not finish), so the SIGPLAN blog is a named unreachable source and not a silent gap; the estate's PDF text reader returned binary control bytes for the JPL coding-rules paper, so that source is mirrored and pinned by the fetch receipt but unread and uncited
2026-10-03	LN121	retract	RETRACTED THE SAME HOUR: item (4) of the queue row above said the emitter has no reader for what the research watch finds. It has one and it was already publishing. A board that carries an .axes file gets /compare/<board>/frontier/ from nx_swcompare_gapmap on every regen (our symbol's presence against keyword momentum over the banked corpus), and the nine axes rows landed today rendered there on the next publish (16654 bytes, was 13302; deadlock read 1 mention and OPPORTUNITY, resource budgets 0 and dormant, multi-language boundaries 7). What is true instead: the radar reads banks written by the researcher fetcher nx_swcompare_research, and nx_catalog reads that fetcher SOURCE-ONLY (never built, promoted, registered or scheduled), so the momentum is computed over banks whose newest record is dated June 2026; and the scanner's separate proposal plane has no page. The discriminating read was the regen receipt, which named the frontier page it published
2026-10-03	LN121	measure	WHY THE WATCH DID NOT RUN WITHOUT A SEAT, MEASURED 2026-10-03 FROM THE CLOCK PLANE AND THE CATALOGUE. nx_clockjob list: 157 effective jobs, 114 in schedule_state WAITING_AUTHORITY with executable_binding UNBOUND, 41 bound to an expected sha256, 3 stopped. The daily attester row (frontierattest, nx_frontier_scan attest all) and the daily topic watch (frontier-watch-daily) are both among the unbound and both show a next_due about ten days in the past with execution_proven=0, so every October attestation on this board so far was a seat's hand run. Three legs of the research watch were dark at once: the bank fetcher unbuilt, the attester unbound, and the proposer on no clock row at all. The radar and the bar ruler were live and therefore read as a working watch
2026-10-03	LN121	land	THE RADAR CORPUS REFRESHES ITSELF. nx_swcompare_research was write-once (a bank that existed was skipped forever) and had never been built. It is rewritten on a decision library (nx_radarbank_lib: first fetch, fresh, refresh, or keep when no bound is given; a staged bank replaces the live one only when it holds a byte, the previous generation is copied beside it as .txt.prev before the rename, and a failed fetch leaves the live bank untouched and is counted kept_stale). The staleness bound is not a number in the source: the clock row passes its own interval. Gate nx_radarbank_gate 62 of 62 on the laptop and on the NAS with no network (the decision at and around a clock-derived bound, the spec row reader, the swap, and the organ end to end on a per-run fixture tree); a mutant of the library was killed with the source restored byte-identical. Promoted nx_swcompare_research 8c8de11d (525932 B) and nx_radarbank_gate 09f4018b (121284 B), both registered. First production run: RADARBANK domain=lang banks=20 fresh=0 refreshed=7 first=13 kept=0 kept_stale=0 failed=0 sum=20 partition=SUMS shrank=5 verdict=GREEN. The seven banks last written in June (age 5110975 s) were refreshed; thirteen were new (nine hazard-class searches and four venue listings over OpenAlex: PACMPL, PACMSE, Empirical Software Engineering, Information and Software Technology; the venue ids were read from mirrored OpenAlex source records)
2026-10-03	LN121	land	THE PROPOSER ASKS ONLY SOURCES THAT COVER THE BOARD AND WALKS THE WHOLE BOARD OVER TIME. nx_frontier_scan gained fs_src_applies (data rows in knowledge/frontier_sources.conf: scope, board, only or skip, kinds, for the board's side; srcfor, kind, boards, for the source's side, so a source added for one board is not asked by the others), watch seeds (every .axes keyword is asked as its own seed beside the deficit rows), a rotation cursor so each pass starts where the last stopped, a propose stamp in the gauge grammar (axes = sources that answered of sources askable, so an unanswered source reads BLIND), a token-share floor from conf (scan_seed_permil), and scanfx, an offline twin of propose that reads fixture bodies so a gate holds all of it with no request leaving the box. Eight sources were added for this board: arXiv cs.PL, cs.SE, cs.CR and cs.LO, and OpenAlex title-and-abstract search inside the four venues above. Gate nx_frontier_scan_gate 64 of 64 on the NAS against the candidate (19 new teeth); a by-hand triple mutant turned exactly the scope, relevance and rotation teeth RED. Promoted nx_frontier_scan f0e045c4 (209584 B) and its gate 74c29e3b (97392 B). The pre-change scanner is banked at knowledge/retired/nx_frontier_scan.elf.pre-ln121-a4dbd86d
2026-10-03	LN121	measure	BEFORE AND AFTER ON THIS BOARD, SAME DAY, SAME ORGAN, AND ONE CORRECTION. Before (every source asked for every board, novelty to the board the only test): sources=17 fetches=84 PROPOSALS=14. I first reported all fourteen as off-subject; reading each record showed THIRTEEN off-subject (a hackathon post, an attendance tracker, a robotics kit, eight papers from Europe PMC in medicine, chemistry and credit scoring, a second forum post and a machine-learning tutorial repository) and ONE on subject: btravstack/unthrown, a library whose description reads explicit errors as values, filed against the errors-as-values row. After (scoped): SCAN-DONE domain=lang deficit_rows=42 rows_scanned=6 sources=25 fetches=48 PROPOSALS=2 population=128 watch_seeds=86 askable_sources=8 answered_sources=8 off_seed=1 empty_seeds=0. The two: a memory-tagging paper whose abstract says use-after-free (on subject) and a code-cleaning toolkit (off subject when read). So scoping removed the noise sources and cost the one real find, which came from GitHub, a source the scope row now leaves out. Two proposals is one pass over 6 of 128 seeds and is not a rate
2026-10-03	LN121	measure	THE THREE BEATS ARE DECLARED, BOUND AND IN THE LIVE PLANE; NONE HAS FIRED YET. nx_clockjob get reads each row plane=LIVE scheduled=1 guarded=1 executable_binding=EXPECTED_SHA256 execution_proven=0: langradarbank every 604800 s (nx_swcompare_research lang 604800, next due 1791670525), langpropose every 21600 s (nx_frontier_scan propose lang, next due 1791087337), langattest every 86400 s (nx_frontier_scan attest lang, next due 1791152137). Cadence reasons: the proposer asks 6 of 128 seeds a pass, so at six hours the whole population is asked in about 5.3 days, inside one weekly bank refresh; the attester is daily because a bar is judged by month and one day is the smallest step a listing date moves; the banks are weekly because the radar reads momentum, not single papers. A bound row fires only while the executable matches its sha256, so promoting either organ again stops its rows until they are re-bound: the re-bind is part of every promote of these two organs. The proof that the watch runs with no seat is a stamp whose timestamp moves at those epochs; it is not claimed before then
2026-10-03	LN121	lesson	A DEFICIT ROW'S LABEL IS WRITTEN IN THE ESTATE'S WORDS AND THE FIELD DOES NOT ANSWER TO THEM. The second pass asked six row labels (the first four content words of each, joined by the source's AND) of nine sources: 54 fetches, every source answered, and the answers held one record in total, already covered by the board. Labels such as the estate builds itself in its fastest proven-sound mode are sentences about this estate, so an empty answer there is the question's fault and says nothing about the field. The 86 watch keywords are the field's vocabulary and are where the watch hears anything; the rotation reaches them after the 42 rows
2026-10-04	LN121	lesson	A TOKEN-SHARE FLOOR CANNOT FAIL ON A SOURCE THAT ANDS THE QUERY WORDS. The relevance floor shipped this morning asks that a record hold half the seed's words. A search that ANDs those words returns only records that hold all of them, so the floor passed 16 of 17 real records when four saved responses were replayed through scanfx (two from GitHub, two from arXiv), and one of the 17 was on subject by its own test. Two attempts at a sharper rule failed on the same replay before one held: pairing any two long words let a robotics kit through on the words with enforced; dropping function words through the estate's stopword list would have erased use after free, because after is on that list. The rule that holds: a record must carry three consecutive words of the row label or watch keyword standing together (every word counts, short ones too), or two consecutive content words of it, never across a double quote. On the 17 records, each one read: 2 proposed, both on subject (the errors-as-values library and the memory-tagging paper), 15 rejected, all off subject. The count of three is a conf row (scan_phrase_ngram) carrying that calibration
2026-10-04	LN121	land	THE PHRASE RULE IS PROMOTED AND THE BEATS ARE RE-BOUND TO IT. nx_frontier_scan 0a3e75e6 (217168 B) and its gate c07444a3 (105016 B) are live; the NAS gate read 78 of 78 against the candidate before the promote (14 new teeth: words standing together across a short word, the same words scattered, words split across two quoted strings, a pair leaning on a function word, a one-word keyword, and a term of art made of three short words matched through its hyphens and refused in another order). The content ruler named one lost string, the six-buckets sentence the seven-buckets sentence replaces. Promoting changed the executable's hash, so langpropose and langattest read BOUND-DRIFT for about a minute and were re-bound (revisions 274 and 275, next-due times unchanged). GitHub is back in this board's scope now that the phrase rule guards it. A dry pass on the promoted binary read SCAN-DONE fetches=54 PROPOSALS=0 askable_sources=9 answered_sources=9 off_seed=1 off_phrase=1. The 14 proposals that read off subject are set REJECTED-OFF-SUBJECT in the proposal plane (counted there: 14); the two real finds stay OPEN for a seat or a later admitter
2026-10-04	LN121	queue	FOUND WHILE RE-BINDING AND NOT THIS LANE'S TO FIX. The bind planner read rows_read=169 bound=41 bound_drift=2 bind_ready=114: siteliveness and toolregreconcile are bound to a hash their executable no longer has (each was promoted again without a re-bind), and the planner calls a drifted row a global barrier for the dispatcher. The clock was dispatching while they drifted (an hourly stamp was four minutes old), so the barrier is at most per row; what it costs is that those two beats do not run. They belong to their owning lanes. The 114 unbound rows include the fleet attester frontierattest, so every board other than this one still gets its bars attested by hand
2026-10-04	LN99	land	THE GOLDEN-DUMP CHECKER IS LIVE ON THE NAS. nx_dumpcheck (func tr_dumpcheck) b3f7e6cf (41050 B) and nx_dumpcheck_gate ad9d8000 (186154 B) are promoted and registered; the library, door and gate sources are in buildroot/runtime and the three dump tests (reduction, elision, closure) in buildroot/knowledge/littests. The gate read 179 of 179 GREEN on the NAS with the NAS compiler (buildroot/_build/nx_compile_x86.sov.elf, taken from its ladder), which settles the one thing the laptop could not: the goldens pin register names read off laptop compiler builds and had never been judged against the NAS compiler. Before that an independent verifier confirmed the repaired rung on the laptop: gate GREEN on both mandated runs, 240 concurrent runs with none RED, GREEN to SKIP and never to RED when the working directory lacks the tree, and no verdict ever computed from an unguarded compile
2026-10-04	LN99	measure	ONE SILENT HOLE THE VERIFIER FOUND WAS CLOSED BEFORE THE SHIP. A test file saved with a UTF-8 byte-order mark lost its line-1 directive without a trace: a violated absence on line 1 read verdict=NONE and exit 0 where the same file without the mark read RED. dck_named now steps over the mark, and four teeth hold it (the marked test keeps its first-line directive, matches what its unmarked twin matches, and a line-1 absence still fires behind the mark, with a fixture tooth that the unmarked twin is RED). Planting the old behaviour turned exactly three of them RED and left the fixture teeth green; the library was restored byte-identical (32bc022e). Two of 15094 sources in the laptop tree start with the mark; no lit test does today
2026-10-04	LN99	queue	LEFT OPEN FROM THE VERIFIER'S REPORT, NONE OF THEM ABLE TO CHANGE A VERDICT TODAY. (1) No tooth holds the canonical form's rule for a trailing blank: a mutant that kept one read 174 of 174. (2) Two header rules have no tooth (a missed positive blocks a later NEXT; a NEXT past the last dump line is refused by name). (3) Two door teeth (the CHECK-ERR run and the empty-dump run) compare the door's line with the library's own rendering. (4) The dump tests are named dump_*.nx, so the lit runner counts them and does not run them; they run through this gate. (5) The gate is not yet on the gate roster and has no organ_gate.conf row. (6) On the laptop the compiler ladder's first rung is a September fossil, so a bare run there reads RED 159 of 166; the gate says so in a SUBJECT-NOTE
2026-10-04	LN100	land	THE THREE FOLLOW-UPS THIS LANE OWED ON THE DIFFERENTIAL GENERATOR ARE LIVE, WITH TWO FIXES AND ONE ADDITION MADE AT REVIEW. Promoted nx_progen_diff e81bcbfc (234152 B), nx_progen_gate f6c47f9c (264496 B), nx_progen_reap_gate e68b99d3 (268536 B); NAS gates 74 of 74 (real compiler) and 139 of 139. What they add: a seed is judged by its LAST ledger row and requeue=<VERDICT> re-runs exactly the seeds whose last row carries it (rows are appended, never rewritten); a slice stops after an implausible run of identical refusals, the run length derived from the ledger's own rate; detach=<log> lets the dispatched process return at once while the slice runs under a lease keyed on the ledger. An independent verifier confirmed the build. At review: (1) the lease read any failure to look at the holder's process as a dead holder, the unsafe direction for a mutex; now only the kernel saying the process is gone counts, and could-not-look reads BUSY (pd_alive_of, eight known answers; the old rule planted fails exactly three). (2) The compiler gate's executables directory was a path relative to the serving root, so the build lane, which starts a gate in buildroot, read every seed as an assembly failure: RED 61 of 74 for a reason that had nothing to do with the generator; it now finds the directory on a ladder and names a missing one as a missing precondition. (3) A detached slice's exit code reaches nobody, so each slice now rewrites a gauge stamp beside the ledger and this board renders it. The promote guard read 23 permil capability loss: seven lost strings, each read (two arena-refusal sentences reworded in the shared syscall library, three verdict literals now composed from a key and a name, two retired function names)
2026-10-04	LN100	measure	THE REPAIR OF THE 15906 FALSE REFUSALS IS RUNNING AND THE ROW IS BACK. The first requeue slice (REFUSED-A, seeds 37800 to 53706) was started detached through the estate's launcher: the launcher returned in 1 ms with the slice's pid, and forty seconds later the ledger's newest rows were seeds 37865 and 37866, both AGREE, so the programs the full disk never wrote now compile, run and agree, at about 1.6 seeds a second. The clock row progendiff is reactivated (revision 277) as the standing fresh run, detached, bound to the new executable; it finds the lease busy while a repair slice runs and continues by itself afterwards. /tmp read 613 permil used with 7.3 GB free before the run
2026-10-04	LN121	land	THE NEW GATES ARE ON AN EXECUTION SURFACE AND THE FEED HAS A BEAT. Five gates were run bare from the serving root (the gate roster's own invocation) and then added to knowledge/gateroster.conf: nx_radarbank_gate 62 of 62, nx_frontier_scan_gate 78 of 78, nx_dumpcheck_gate 179 of 179, nx_leaderboard_fleet_gate 199 of 199, nx_progen_reap_gate 139 of 139; the compiler-backed nx_progen_gate takes minutes and is left off on purpose. knowledge/organ_gate.conf gained the two pairs no derivation rule reaches (nx_swcompare_research to nx_radarbank_gate, nx_leaderboard to nx_leaderboard_fleet_gate). The exploited-vulnerability feed the LN109 census will read now has a stable path and a daily bound clock row (kevfeed, revision 279: nx_research_fetch to knowledge/fetched/cisa_kev_current.json); the first fetch saved 1765906 bytes, the same digest as the pinned citation mirror, which stays untouched because its pin is its hash
2026-10-04	LN109	queue	BUILT AND REFUSED BY ITS VERIFIER ON ONE GROUND, REPAIR IN FLIGHT. The census gave the right answer on every probe, including the real 1733-record catalog, where an independent count agreed on every figure (CWE-416 93 records and 7 in 2026, 249 added in 2026, longest gap between publishing days 8). The gate lacks negative controls on the gauge stamp: four one-line regressions left it 255 of 255 while the stamp would read clean beside a RED census. Also found: a catalog with zero records reads GREEN, one mistyped later year takes the whole ranked list out of force, and an artifact that cannot be executed reads RED instead of a missing precondition. A repair seat has those plus the verifier's nine surviving mutants; the production conf, the census clock row and its gauge row land after the re-verification
2026-10-04	LN100	measure	THE FIRST REPAIR SLICE ENDED THE WAY THE DESIGN SAYS, AND ITS OWN LINES ARE THE RECEIPT. PROGEN-DIFF-SLICE interval_s=1800 budget_ms=1080000 elapsed_ms=1080157 seeds_planned=15906 seeds_run=2811 stopped=BUDGET; PROGEN-DIFF seeds=2811 agree=2811 disagree=0; the lease read RELEASED; PROGEN-DIFF-STAMP gauge=0 axes_known=1 axes_total=1 cadence_s=1800; PROGEN-DIFF-LEDGER rows=56517 distinct_seeds=53706 superseded=2811 agree=40609 disagree=0 refused_a=13095 asmfail=2 sum=53706 partition=SUMS; PROGEN-DIFF-REQUEUE selected=15906 rerun=2811 skipped=1 left=13095. That is 2.6 seeds a second. The remaining 13095 are running as one detached slice with no beat budget (pid 25643, about 85 minutes at that rate), and the clock's fresh slice reads the lease busy until it ends. The two ASMFAIL seeds are 37799 and 39735: the first is the seed the disk filled on and the second sits inside the run of false refusals, so both are disk artefacts and not findings; the REFUSED-A requeue skipped the second by design (its last row is not REFUSED-A), and requeue=ASMFAIL from=37799 to=39735 repairs both once the lease is free

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

SOTA field — 15 peers, 50 axes, measured bindings

15 languages (majors, best-designed, and the specialists a mathematician, a statistician, a prover or a symbolic-computation user reaches for: Julia, R, Lean, Mathematica), 50 axes, 8 categories. Nishi cells measured (gates with dates); the 11 rival columns are documented capability presence as of July 2026, the three specialist columns as of September 2026 (Julia 1.13.0, R 4.6.1, Lean 4.34.1). Demand weights = 1651 banked oracle bugs. Frontier ladder: /compare/lang/frontier

How the field is scored. A state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured or published numbers (Nishi’s column is measured on this estate, competitor columns are researcher-sourced and cited in the note); grade axes carry Best / Yes / Part / No for every peer. A Nishi grade may be bound to an organ and a symbol and is then re-measured on every publish by the one symbol ruler the capability matrix above uses; an over-claim refuses to publish.

field, strip order:RustZigGoSwiftKotlinTypeScriptPythonCElmOCamlHaskellJuliaRLeanMathematica·BestYesPartNo

Measured bindings. 26 of the Nishi grades on this page are bound to an organ and a symbol and re-measured on every publish by the one symbol ruler; the drift classes are counted below and their sum is re-derived beside the bound total.

Measured bindings, counted
Class	Count	Note
consistent	7	the grade and the symbol agree
stale-under	0	the grade says No while the organ carries the symbol; published with the badge, named by the gate until raised
unbacked	0	a claim over an absent symbol refuses to publish
unresolved	1
unreadable	0
unserved	18	the organ carries the symbol in source while its binary is not on the serving surface: built nowhere, invisible to symbol presence; published with the badge, never refused
partition sum	26	RECONCILED: the parts sum to the total 26

Measured stakes (quantitative)

Native speed vs C (measured / documented)

MODES LEG 2026-09-01: MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. The f1 and drag arms remove exactly the checks the loop guard proves (LN7b) and nothing else; the daily and checked arms pay for LN1 checked arithmetic lowered as six IR instructions per add, which is the next codegen rung (add+jo). EARLIER THE SAME DAY, AGAINST THE PROMOTED TOOLCHAIN (nx_cc_sovereign 778,655 B): identical bounds-checked hot loop, 7 runs per arm, every arm printing checksum 31447040000 -- NishiLang checked 7,152 us median vs gcc -O2 2,148 us = 3.33x (a second independent run 7,241 vs 2,093 = 3.46x); Rust -O checked 4,371 us = 2.03x; Go 4,196 us = 1.95x; clang -O2 1,128 us = 0.53x (it vectorises the loop gcc does not). The Aug-19 laptop copy of the compiler measured 8,508 us on the same host, so the LN7 register-allocation rung is worth 16 percent on this loop, reproduced. The receipt is knowledge/compare/lang.bench (host, every toolchain version, every source and binary sha256, min and median, the exact repro command), rendered on this page as the Measured head-to-head section and refereed by nx_lang_h2h_gate, whose reader re-derives the verdict from the rows. HONEST STANDING: NishiLang is NOT a peer of gcc or Rust on this loop yet -- 3.3x gcc -O2 and 1.6x Rust-checked -- and the rung that closes most of that gap is LR7 sound bounds-check elision (the UNCHECKED NishiLang lane measured 2.02x gcc on 2026-08-14). Nishi MEASURED Stabilizer-validated 2026-05-20 [stabilizer2013] (bench/paired_native_microbench.tsv) vs gcc -O0; root cause stack-machine x86-64 backend, regalloc wired into RISC-V only [poletto1999]; peer columns = commonly documented ranges vs C. RE-MEASURED 2026-08-14 on the CURRENT compiler (674,866 B, eleven promotions later) with bench/nx_lang_h2h.sh, an identical bounds-checked hot loop where all four arms must print the same checksum or the run is void: gcc -O2 unchecked 2,270 us . Rust -O checked 5,041 . NishiLang checked 10,237 . NishiLang UNCHECKED 4,581. So against gcc -O2 the unchecked lane is 2.02x and the checked lane 4.51x. THE FINDING THAT RE-RANKS THE PERF WORK: NishiLang unchecked (4,581) lands within 9 percent of Rust CHECKED (5,041), i.e. the raw codegen is already at the checked-language tier, while the bounds check itself costs 2.23x on this loop. That first pointed the next rung at proving checks away -- and then READING THE EMITTED ASSEMBLY for one checked access moved it again, which is why the assembly is quoted in the ledger rather than summarised. Per iteration of a bounds-checked accumulate loop the backend emits roughly seventeen instructions, of which the check is two compares and two branches while SIX are pure memory traffic: the loop counter lives in r12 and the accumulator in r13 for the whole loop -- register allocation demonstrably worked -- and the emitter STILL spills both to stack homes on entry and reloads the counter twice more, once for the high check and once for the address computation, from a register that never changed. So the dominant cost is not the check and not the missing phi nodes (the two loop-carried values are already in registers); it is that THE BACKEND DOES NOT CONSUME THE REGISTER ALLOCATION IT ALREADY COMPUTED, materialising every value through its stack slot at every use. That is now the ranked number-one perf rung, it is witness-backed by runtime/nx_probe_bchk_asm.nx rather than argued, and it explains why round 3's assembly dump reached the same conclusion in July and was read as a phi problem instead. Stated honestly: this is a DIFFERENT benchmark and a DIFFERENT baseline from the 3.65x figure above (that one is vs -O0 on the paired microbench and has NOT been re-run), so the two numbers are not comparable and neither refutes the other

Rust ~1xZig ~1xGo ~1.2-2xSwift ~1.1-2xKotlin ~1-3x JITTypeScript JIT variesPython ~10-100x interpC 1x barElm n/a (JS)OCaml ~1-2xHaskell ~1-3xJulia ~1-2x JITR ~10-100x interpLean ~1-3x via C emitMathematica interp kernel; FunctionCompile (LLVM) ~1-3x

2.0x gcc -O2 in f1 mode, 3.4x default, 5.1x daily (receipt)

Nishi, measured

External defect oracles ingested + classified

langintel- planes: 669 rust I-unsound + 982 LLVM miscompiles, injection-scanned 0/1651, classified into 26 ranked capability axes; top demand compiler-miscompile-codegen 638 = the build order (SSOT knowledge/store/langintel-requirements-)

Rust tracker onlyZig tracker onlyGo tracker onlySwift tracker onlyKotlin tracker onlyTypeScript tracker onlyPython tracker onlyC tracker onlyElm tracker onlyOCaml tracker onlyHaskell tracker onlyJulia tracker onlyR tracker onlyLean tracker onlyMathematica tracker only

1651 banked

Nishi, measured

Minimal static native binary (bytes)

Nishi measured 2026-08-13: 188 B return-42 ELF with --no-crash-guard (the deliberate minimal lane); the crash guard is DEFAULT-ON since 2026-08-13 pm and costs +4.9 KB (guarded return-42 = 5,105 B) -- still half of Zig's ~10 KB and 60x under C's typical static; peers = documented typical hello-world static/stripped order-of-magnitude

Rust ~300 KB strippedZig ~10 KBGo ~1.5-2 MBSwift ~500 KBKotlin n/a JVMTypeScript n/a JSPython n/a interpC ~16 KBElm n/a JSOCaml ~1 MBHaskell ~1 MBJulia n/a JIT imageR n/a interpLean n/aMathematica n/a (kernel)

188 B opt-out / 5.1 KB guarded

Nishi, measured

Native backends in one shipped toolchain

Nishi counts only true native ELF backends on this axis (x86-64 + RV64 in one sovereign binary); wasm is deliberately NOT counted here -- not a native backend; Zig 0.15 ships its self-hosted x86 backend [zig0151]; Go owns its backend

Rust LLVM (ext)Zig LLVM + own x86Go own, 12+ targetsSwift LLVMKotlin JVM + LLVM nativeTypeScript JS emit (non-native)Python bytecode VMC gcc/clang allElm JS emit (non-native)OCaml own native + byteHaskell GHC NCG + LLVMJulia LLVM (ext)R bytecode VMLean C emit (ext)Mathematica LLVM via FunctionCompile (ext)

4 doors end to end on one fixture: x86-64, RV64, wasm32, wasm64 (nx_door_census 2026-09-27)

Nishi, measured

Memory safety and soundness (the public-bug-dump ring)

Compile-time memory safety enforcement

PART SINCE 2026-08-25: the --ownership DECLARED MODE (own_check_move plus own_check_uaf in nx_ownership; nx_ownership_gate 19/19 GREEN on the promoted toolchain, mutation bite killed=1) refuses use-after-move and use-after-free naming the dead local and the line its life ended on; the default is OFF until the per-class ratchet flips it after a clean corpus census, which is the distance to Yes. Rust borrow checker is the bar [rust-ownership] yet 669 I-unsound bugs banked = even the leader leaks (our oracle lane measures it); Nishi raw pointers SIGSEGV -- filed; equiv net GREEN 2026-08-05 = the enforcement lane is OPEN (standing rule: every nx_cc change passes nx_cc_equiv_gate before promotion)

bound to runtime/nx_ownership.nx:own_check_move · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Bounds-checked access (CWE-787/125)

PART, measured 2026-08-23 on the live compiler: typed arrays [N]T and slices []T are bounds-checked BY DEFAULT (NX_BOUNDS_CHECK_LIVE, the LB4 rung, cost measured 2.23x on the checked hot loop) and the raw-pointer half -- the READ-TO-NUL over-read class -- traps only under the --ptrprov DECLARED MODE (LN3, shipped 2026-08-19: exit 71, CWE-125 read and CWE-787 write legs, a provably out-of-range constant index refused at parse time; nx_boundscheck_gate 11/11 GREEN re-run 2026-08-23 after the LN2 promote). Default stays OFF for raw pointers until the per-class ratchet flips it after a clean corpus census, which is the distance to Yes. CISA memory-safe roadmap (banked langbug.q 2026-07-10) [cisa-memsafe] puts this class at the top of what bites C; our 2026-07-08 READ-TO-NUL over-read was exactly this class in the wild

bound to runtime/nx_parse.nx:NX_BOUNDS_CHECK_LIVE · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Use-after-free prevented (CWE-416)

SHIPPED 2026-08-25 inside the --ownership mode: after sys_munmap(p, n) any read of p is a compile error naming the local and the release line (own_check_uaf, nx_ownership_gate 19/19), and a double free falls out of the same rule; default OFF until the ratchet flips it, so PART. Arena no-free doctrine mitigates in practice (nothing frees) but no checker ENFORCES it; Rust the bar; 24 Pin-class bugs in the oracle corpus show the hard tail

bound to runtime/nx_ownership.nx:own_check_uaf · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Integer overflow checked (CWE-190)

PART, SHIPPED 2026-08-23 as the --chkarith DECLARED MODE (LN1): an i64 add, subtract or multiply whose result leaves the i64 range TRAPS with exit 72 naming CWE-190 and the fix, MIN times minus-one traps the same way instead of SIGFPE, __wrap_add / __wrap_sub / __wrap_mul are the exempt intent-declaring forms, and a constant overflow is REFUSED at parse time (capability=checked-arith-const-overflow); nx_chkarith_gate 17/17 GREEN live (passed 9/17 against the banked pre-LN1 compiler: exactly the mode teeth), nx_cc_equiv_gate 10/10 plus selfhost GREEN, default builds byte-identical. Under the default i64 still wraps silently, and the default stays OFF until the per-class ratchet flips it after a clean corpus census -- that flip is the distance to Yes. FIRST RUNG SHIPPED 2026-08-13 on the neighbouring silent-wrong-value: a CONSTANT shift count outside the result width is now REFUSED at compile time, because the processor keeps only the low bits of the count and the program would otherwise compute a different shift than the one written -- MEASURED before the fix: 1 shifted left by 70 compiled clean, ran, and returned 64 (70 becomes 6). The refusal names the legal range, the fix, and capability=shift-count-range; runtime counts and in-range counts are gate-controlled to keep compiling, since an over-eager check would refuse the overwhelmingly common shapes. CORRECTION, measured not remembered: this cell's older note claimed an over-shift 'blanks the emitted .s' (2026-07-06) -- STALE, it compiles and returns the masked value. Zig safe-mode + Swift trap-by-default + Python bignum lead on the overflow half; Go wraps by definition

bound to runtime/nx_checked_arith.nx:chk_add_overflow · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Null / sentinel-zero deref prevented (CWE-476)

PART, SHIPPED 2026-08-23 as the --optenforce DECLARED MODE (LN2): a dereference of a pointer-typed local not proven non-null on its path is REFUSED at parse time naming the local and the rule (capability=option-enforce-unwrap); proof comes from the idioms this corpus already writes (if p != 0 then-block, the early-exit if p == 0 return/break/continue/sys_exit, the else-block, while p != 0, nx_assert_ptr) and a reassignment re-derives the bit, so a stale check does not survive p = call(). Declared floors, each measured against the stdlib: parameters and module statics trusted, sys_mmap results non-null by the allocator contract, int-to-pointer casts trusted, chained derefs through fields or calls unchecked (bind to a local first). nx_optenforce_gate 14/14 GREEN live (hazard refused at p.val, the reassign witness refused, the nine-idiom positive control compiles and runs under the mode with byte-identical asm so the mode emits no IR), 9/14 against the pre-LN2 compiler; nx_cc_equiv_gate 10/10 plus selfhost GREEN. Sentinel-zero-as-null is our recurring P2 meta-class; Option and Result EXIST in the stdlib and the mode now enforces the checked path for locals; default stays OFF until the per-class ratchet flips it after a clean corpus census -- the distance to Yes. Elm ships no null at all

bound to runtime/nx_option_enforce.nx:opt_enforce_unwrap · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Compile-time data-race prevention (CWE-362)

Swift 6 strict concurrency joined Rust Send/Sync as the 2026 bar; Go ships a runtime race detector; Nishi pool is real (7x measured) but untyped

UB / poison semantics defined and checked

54 poison/undef oracle bugs banked (demand rank 3); C UB is the negative bar; managed languages define semantics; Rust unsafe still carries UB (miri checks it). FIRST RUNG SHIPPED 2026-08-13, chosen by MEASURING the edges rather than by taxonomy: the compile-time-decidable UB shapes are being refused one at a time with the capability voice -- constant out-of-range shift counts land first (silent masked-shift, measured 1<<70 = 64 pre-fix), and the runtime traps that remain now SPEAK instead of dying silently (a divide-by-zero SIGFPE prints the arithmetic-trap diagnosis and the divisor advice; that fix-line classifier was itself corrected the same day after it wrongly printed the null-pointer hint on an arithmetic trap -- a wrong hint is worse than no hint). Still No overall: the class is not closed until poison/undef semantics are DEFINED, not merely refused case by case

Type system and correctness

Sum types + pattern matching

Payload ctor + match probes re-verified run-exit=0 2026-07-09; exhaustiveness and unreachable-arm refusal ENFORCED since 2026-08-05 (the next axis carries the proof); Elm/OCaml/Haskell ADTs are the bar; Go lacks sum types

bound to runtime/nx_parse.nx:parse_stmt_match · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

Match exhaustiveness enforced

SHIPPED 2026-08-05, bite-witnessed refuse+accept through /api/build (nx_parse: non-exhaustive match: 2 of 3 variants handled) with the witness in-tree (nx_probe_exhaust_live.nx): EnumEntry now records n_variants and parse_stmt_match counts DISTINCT discriminants (values not arm positions, so duplicated arms cannot fake coverage and explicit = N variants stay correct); gated nx_cc_equiv_gate 10/10 + selfhost -- which doubled as the estate backfill census (zero non-exhaustive matches, so no amnesty was needed) -- and promoted through promote_toolchain canary GREEN. DIAGNOSTIC PARITY-PLUS with Elm (the reason this cell moved to Best): the message CITES THE LINE, NAMES THE ENUM, and NAMES THE MISSING VARIANTS -- nx_parse: line 1118: non-exhaustive match on enum ExhColor: 2 of 3 variants handled -- add an arm for: Blue (no new storage: variant names already live as Enum::Variant module consts). PLUS a second check Elm/Rust-class but ours by construction: UNREACHABLE ARM refusal, citing BOTH lines -- nx_parse: line 1121: unreachable match arm ExhColor::Red -- already handled by an earlier arm of the match at line 1118. Declared narrowness: discriminants outside 0..63, or an unresolvable enum, decline the verdict rather than guess

BEST

Call arity + param-type checking

COMPILER-ENFORCED and bite-proven live 2026-08-05 via /api/build, both refuse+accept directions witnessed in-tree: ARITY (call arity mismatch, forward refs via pre-registered stubs; nx_probe_arity_live.nx) + POINTER-into-INTEGER types (argument type mismatch, the sev-8 silent-zero shape, 0 measured false positives; nx_probe_ptrint_live.nx) + duplicate-definition guard. FULL BOTH-DIRECTION TYPE REFUSAL SHIPPED 2026-08-05 after TWO root fixes, each gated (nx_cc_equiv_gate 10/10 + selfhost) and promoted through the canary toolchain door: (1) the trailing `as T` cast MUTATED THE OPERAND in place, so any local ever written `p as i64` read as INTEGER at every later call -- a silent wrong-type class for every casting caller; cast now emits a typed identity (equiv gate 10/10 + selfhost, toolchain-promoted canary GREEN, witnesses nx_probe_castmut_live/2). and (2) POINTER ARITHMETIC DECAYED TO i64, so the corpus idiom emit(out + o, cap - o) handed a POINTER the parser believed was an INTEGER -- that was the whole 57/70 residue, i.e. the check had been RIGHT about a type the parser had already lost. Named by the equiv gate's newly-captured compiler stderr (a gate that reports a failure without its diagnostic makes the failure unactionable). BOTH DIRECTIONS now refuse, bite-witnessed refuse+accept on the live compiler (nx_probe_intptr_live.nx / nx_probe_ptrint_live.nx). Integer LITERALS stay exempt by design (sentinel/null idiom); fn-pointer calls remain unverifiable by name; arity census crons daily

YES

Generics / parametric polymorphism

Full monomorphization port landed (parse.nx instantiate_generic_n); Rust traits + Haskell typeclasses lead depth; Go type sets since 1.18 [go118]

bound to runtime/nx_parse.nx:instantiate_generic_n · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

HM-class type inference

Explicit-declaration is a named stance (reads better at audit time) yet stays a No under less-than-SOTA-never-design until measured as an exceed

Effect tracking / purity

OCaml 5 effect handlers + Haskell monadic IO + Elm purity are the frontier; watch-class for the substrate

Concurrency

Lightweight concurrency (CSP / actor / async class)

nx_chan Vyukov MPMC + ring-arena pool 7x measured (2026-07-06 gate); goroutines the industrial bar; Zig async dropped in 0.15 pending redesign

bound to runtime/nx_thread_pool.nx:nx_pool_submit · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Structured concurrency

PART SINCE 2026-08-25: scoped spawn LANDED (sc_scope_spawn in nx_thread_pool): join is the only exit, an unjoined scope refuses to free, a child error names which child and cancels the scope, and all 48 nx_pool_submit call sites are byte-for-byte unchanged so colourlessness is preserved. ENFORCEABLE, NOT YET ENFORCED: sc_strict_set(1) makes the bare submit refuse, but it ships OFF because 35 production call sites still use bare submit, and it is a runtime rule where Swift 6 and Kotlin scopes are compile-time law. Swift task trees + Kotlin coroutine scopes = the 2026 design bar; Python TaskGroup 3.11; Go errgroup is a library

bound to runtime/nx_thread_pool.nx:sc_scope_spawn · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Colorless functions (no async split)

Explicit threads + channels = no function coloring by construction; OCaml effects give colorless concurrency; Rust/Swift/Kotlin/TS/Python all carry the async split

YES

Errors and diagnostics

Errors as values, enforced

Option/Result exist in the stdlib unenforced; the estate-wide refusal-with-reason-and-fix convention is real but convention, not type system; Zig error unions + errdefer; Swift typed throws

PART

Compiler diagnostics (caret, did-you-mean, multi-error)

CARET + DID-YOU-MEAN ARE SOVEREIGN NOW (2026-08-05), bite-witnessed: nx_parse: line 1116: call to undefined function 'dym_helpr' -- did you mean 'dym_helper'? (bounded Levenshtein over the module function table; witness nx_probe_dym_live.nx). It stays SILENT when nothing is near -- a wrong suggestion is worse than none. Every enforcement diagnostic shipped today cites a LINE and two cite BOTH lines (duplicate definition; unreachable match arm). CARET SHIPPED the same day and bite-witnessed end to end: nx_parse: line 1116: call to undefined function 'dym_helpr' -- did you mean 'dym_helper'? / then the offending source line / then ^ under the call. Plumbed ADDITIVELY (a module static the driver fills; unset = no snippet, never a wrong one) so no parse_module caller changed. FIRST ATTEMPT PRINTED THE CARET UNDER THE WRONG LINE (P.pos had advanced past the call, landing on the NEXT statement) and was corrected before promotion by anchoring on the call's own token -- A CARET THAT POINTS AT THE WRONG LINE IS WORSE THAN NO CARET. Arity + undefined-call diagnostics now share that anchor. MULTI-ERROR RECOVERY SHIPPED 2026-08-05 late (gate 10/10+selfhost, canary GREEN, witness nx_probe_multierr_live.nx): 12 semantic sites (undefined call/ident, call arity, arg types, unknown type, non-exhaustive match, unreachable arm, duplicate definition, const-before-decl, bad assigns) now note-and-continue, closed by a hard end gate -- nx_parse: N error(s) -- no output emitted -- so a broken build reports EVERY error in ONE compile and recovered (poisoned) IR can never reach codegen; parser-desync sites stay fatal BY DESIGN (past a desync every diagnostic points at innocent code); cap 20. DID-YOU-MEAN NOW COVERS BARE IDENTIFIERS (witness nx_probe_dym_ident_live.nx: line 1117: UNRESOLVED identifier 'countr' ... -- did you mean 'counter'? plus source line + caret; suggestion pools = live locals window + module consts + function table, ZERO new indexes; the UNRESOLVED diagnostic also gained its line number + caret via the one-slot-back token anchor, verified by emitted bytes). TYPE-NAME DYM TOO (same evening, witness nx_probe_dym_type_live.nx): unknown type name 'TypoPont' (not a primitive, struct, or registered type alias) -- did you mean 'TypoPoint'? -- pools = declared struct table + active generic type params; primitives deliberately excluded (2-4 char names make distance-1 suggestions noisy) and the narrowness stated in-source; gated 10/10+selfhost, canary GREEN. THE 5W+H / ELM-CLASS VOICE IS LIVE ON THE UNDEFINED-NAME FAMILY (2026-08-06, three operator escalations in one night: metadata notes -> quoted declarations -> the full invested logging standard, nxc2-5wh-substrate 2026-04-29 + elm-class-friendliness CARDINAL 2026-05-07). A missing name now reads, verified by emitted bytes end to end through /api/build diag_errors: error at line 1118: I do not know the name 'dym_helpr' -- it is called here, but nothing in this program defines it. / source line + caret / why the build stopped: this name has no definition, so the program would have nothing to run here -- building on would ship a crash or a wrong value at this exact spot. / closest defined name: 'dym_helper', declared at line 1116: + the declaration QUOTED / fix: if 'dym_helper' is the one you meant, change the spelling to match it; if not, define 'dym_helpr' yourself or import the file that provides it. / error: the build found 1 problem(s), listed above, and wrote no program. Rubric self-score ~24/25 (WHAT 5 WHERE 4 WHY 5 HOW 5 NO-JARGON 5; the missing WHERE point is the file name -- the per-file rung). Internal organ prefixes are GONE from these messages. SHIPPING THE VOICE ALSO EXPOSED A STACK TRUNCATION: hostctl echoes only the last 600 bytes of the builder's capture, smaller than ONE 5W+H diagnostic -- the mgmt API now reads the builder's full capture directly, so the API surface carries the whole message. Suggesters are silent stashers; one printer owns the voice; locals resolve by nearest-above scan (shadowing-correct); a const names its evaluated value. REMAINDER CLOSED ON THE HIGH-FREQUENCY SITES (2026-08-13): call arity, reassigning a 'let', duplicate definition, and reserved-keyword-as-name -- the four mistakes any author arriving from another language makes first -- now speak the same what/why/how voice as the undefined-name family, all reported in ONE compile (arity now names the CONSEQUENCE: a missing argument is not empty, the callee reads a leftover register, so the wrong value moves when unrelated code moves and the crash never points back at the call). These are USER ERRORS and deliberately carry NO capability= slug, which is what keeps the demand journal an honest signal of missing CAPABILITY rather than a log of typos. Still on the old organ-prefixed voice: exhaustiveness, unreachable-arm, const-before-decl and the desync sites (anchored by the diag_errors dual-anchor until their rewrite). RUNTIME crash diagnostics (2026-08-13, rungs 1a+1b BOTH shipped same day): SIGSEGV/SIGBUS/SIGILL/SIGFPE now print instruction + fault addresses in the same 5W+H voice and STILL die by the original signal (wait-status unchanged) -- and this is DEFAULT-ON FOR EVERY PROGRAM: the driver appends the self-contained guard and the parser injects the arming call at main entry (--no-crash-guard opts out; measured +4.9 KB per binary; run-behavior byte-equal across the whole equiv corpus). Stack overflow is covered via a 32 KiB alternate signal stack, and the fault classifier names UNBOUNDED RECURSION when the touched address sits at the stack boundary instead of misdirecting to the null-pointer hint. Witnesses prove the EXACT planted fault address prints, the bare-program injection, the opt-out silence (attribution control), and the overflow diagnostic. The resolve loop is now ONE COMMAND: every crash diagnostic prints its own program path (readlink /proc/self/exe) plus the exact nx_addr2line invocation -- the shipped CLI (now REGISTERED over MCP; it was PROMOTED-UNREGISTERED, a real binary nobody could call) prints file:line AND the function name on a -g build and honestly REFUSES (rc=4) without .debug_line. In-process resolution is deliberately NOT embedded: it would drag the DWARF decoder into every ~5 KB guarded binary; the one-command offline loop is the design, stated on the diagnostic itself. CAPABILITY-LIMIT VOICE (2026-08-13 night): when the honest answer is NOT-POSSIBLE, the diagnostic now says whether that is a design stance or a roadmap gap, teaches the supported way, and stamps a greppable capability=<slug> marker at the moment of friction -- (1) a float value into an INTEGER binding used to COMPILE CLEAN and silently store the raw IEEE-754 bit pattern (measured: 1.5 became 0x3FF8000000000000, no diagnostic); EVERY store site -- let, var-init, plain assignment, pointer deref (*p = 1.5), array subscript (a[i] = 1.5), and struct field (s.f = 1.5) -- now refuses through ONE shared guard whose destination type is the pointee/element/field, so float MEMORY stays fully legal (*f64 deref-store control gated) while every integer destination refuses; the first cut covered let only and re-checking the published claim caught the divergence (the multi-error compiler reports all three memory sites in a single build), teaching Q14 fixed-point and leaving the float lane reachable via : f64; (2) the parameter-cap refusal teaches the struct-pointer idiom instead of naming IR internals; (3) the crash guard's pointer branch teaches CHECKED access ([N]T and []T refuse out-of-bounds with a message). The slugs feed the AI-friction transcript mine, so real user friction re-ranks the public roadmap -- the same loop that chose every rung shipped today. HONEST REMAINDER: line numbers are EXPANDED-source lines (per-file mapping is its own rung) and rustc/Elm still carry error codes, --explain prose, and structured/JSON output we do not. Elm + rustc the bar [elm-errors]

bound to runtime/nx_parse.nx:nx_diag_caret · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

Tooling ring

Language server / IDE integration

SHIPPED 2026-08-25: nx_lsp LIVE (436,114 B, registered, invoked), LSP 3.17 over stdio served FROM THE COMPILER'S OWN FRONT END and never a second parser (the rust-analyzer architecture bar [matklad-ide]); every diagnostic the editor shows is the shipping caret and did-you-mean text verbatim; it advertises ONLY textDocumentSync=Full, definitionProvider and hoverProvider, so completion, rename, references and incremental sync stay unadvertised and rust-analyzer, gopls, IntelliJ and the TS server still lead there; nx_lsp_gate 19/19 GREEN on the live binary, mutation bite killed=1. Yes, not Best: the served surface is a subset of the field's

bound to runtime/nx_lsp.nx:lsp_serve · measured PRESENT (decl) · CONSISTENT

YES

Canonical source formatter

SHIPPED 2026-08-23 (LN9, nx_srcfmt, symbol srcfmt_emit): one canonical style with no options, the gofmt shape, and the style was MEASURED from the whole corpus rather than chosen (18,801 files, 2.97 M lines: 4-space indent 2,216,007 vs 9,644; brace on the opening line 179,575 vs 2; joined else 33,968 vs 5,444; struct field type columns aligned in 1,340 of 1,712 multi-field runs) -- a census verb prints the same numbers from the same scanner so the rule and its ruler cannot drift. Comments, string literals and @-directives are preserved byte for byte, and a token-stream ORACLE built on the compiler's own lexer refuses any output whose tokens differ from the input, so nothing is ever written unless the oracle agrees. Proof over the FULL population, not a sample: 18,809 of 18,815 sources format idempotently (fmt(fmt(x)) == fmt(x), 0 exceptions, 0 comment losses) and build to byte-identical assembly; the 6 remaining files use @for range expansion or @macro gensym substitution the formatter does not model and are REFUSED (exit 3, nothing written) -- the declared floor. nx_srcfmt_gate 13/13 GREEN live, bite-proven both ways (alignment killed -> 12/13 RED; oracle broken -> 12/13 RED). The corpus itself is NOT reformatted yet: applying the formatter tree-wide is a separate decision. gofmt set the standard; zig fmt, swift-format, prettier, black follow.

bound to runtime/nx_srcfmt.nx:srcfmt_emit · measured PRESENT (decl) · CONSISTENT

YES

Incremental compilation / build cache

SHIPPED 2026-08-25: nx_inc_compile LIVE (97,470 B, registered, invoked), a per-module cache keyed by the closure sha the build door already computes -- it replays nx_closurehash's key, one key authority not two, three recorded keys byte-equal to /api/build's own closure_sha256 -- with a member list that is a deliberate SUPERSET of the ruler's closure so it errs toward an extra rebuild and never a false hit; measured on the real corpus, 6 targets over 18 modules decided in 5 ms with zero forks. Yes, not Best: the build door does not yet consult it on every build (adoption is the open rung), where every peer's cache is on by default

bound to runtime/nx_inc_compile.nx:inc_cache_lookup · measured PRESENT (decl) · CONSISTENT

YES

Debugger + debug info (DWARF / source maps)

STATEMENT STEPPING SHIPPED 2026-08-25 (nx_dbg_step; nx_dbg_step_gate 29/29 GREEN on the live binary, mutation bite killed=1): breakpoint by file and line, step into and step over on our own .debug_line over an RV64 fixture, never-brick by construction (no ptrace anywhere, breakpoints are a bitmap, code bytes measured unchanged). STILL PART as a conjunction: .debug_info carries function names only, types and variables ABSENT. DWARF v5 .debug_line at STATEMENT granularity, OPT-IN via -g: the compiler emits .file/.loc, nxasm accumulates (address,file,line) and encodes the line program, and the ELF carries the section behind a section-header table. PROVEN END-TO-END 2026-08-07 by nx_dwline_e2e_gate 14/14 -- it drives the real nx_cc_sovereign + nxasm_x86_main, and recovers source lines 5 and 9 from real addresses in the emitted ELF; its load-bearing tooth is the negative control that WITHOUT -g there is no .debug_line at all, so the measured 168 B minimal static binary is untouched. Encoder and decoder are independent organs sharing no code and agree on 13/13 (nx_dwline_roundtrip_gate), and GNU readelf resolves the same addresses, so third-party gdb/addr2line interop is real rather than asserted. STATEMENT granularity landed 2026-08-07, MEASURED AT CORPUS SCALE against the previous build rather than asserted on a fixture: THE ENTIRE RUNTIME CORPUS -- all 11,379 files attempted, 11,121 built (97.7 percent), covering 1,725,477 functions. This is a census, not a sample: no curation, no window, nothing excluded. The 259 files that did not compile are PRE-EXISTING failures, not caused by this change -- in every window where both compilers ran, the built counts were identical under each (377 of 377, 400 of 400). The blessed function-granularity compiler emits EXACTLY one .loc per function, and that 1:1 identity is the control tooth: it held ON THE NOSE in every window where it was independently measured (78,399 rows for 78,399 functions across the two both-compiler windows). The new compiler emits 18,835,389 rows over the same population -- 10.9x denser -- with ZERO per-file regressions across all 11,121 files and no file losing its line info (nx_dwline_corpus_gate, which NAMES every regressing file individually and named none). Where the run used the derived baseline for speed it was CROSS-VALIDATED first: fast mode reproduced the both-compiler numbers EXACTLY on an identical 400-file range (31,000 functions, 165,800 rows, 400 improved, 0 regressed), and the invariant is deliberately NOT asserted in derived mode because that would be circular. The narrow proof is also kept: nx_dwline_stmt_gate 13/13 shows all four source lines of a two-function probe recovered from real addresses in the emitted ELF, with a baseline tooth asserting the OLD compiler LACKS the statement lines so the gain is attributable. Line numbers ride OUT OF BAND keyed by instruction pointer -- struct Instr was NOT widened -- and nx_cc_equiv_gate stayed 10/10 + selfhost with byte-identical ea/eb on every row, proving the change is inert when -g is off. STILL PARTIAL and graded as one: .debug_info (types and variables) and an actual stepping debugger are ABSENT, and this axis is a conjunction -- debug INFO without a debugger is not a debugger. gdb-on-C stays the bar; both are filed rungs, not design choices

bound to runtime/nx_dbg_step.nx:dbg_step_over · measured PRESENT (decl) · CONSISTENT

PART

REPL / interactive development

Python REPL + notebooks the bar; wasm target + nishi-pages could host ours (queued)

Package ecosystem / supply chain

PART SINCE 2026-08-25: pkg_cas_resolve LANDED in nx_pkg (63,205 B promoted, registered, invoked; nx_pkg_gate 19/19): a module resolves by sha256 digest with no version negotiation and ZERO install-time execution proven mechanically (an install hook fires when executed and is absent after a resolve), and a typosquat refuses name-not-pinned. Not Yes: no signature layer, a one-writer unsigned journal, and the compiler import path still resolves by filesystem name. Deliberate different-path bet: content-addressed substrate, no version negotiation, zero dependency-confusion surface -- still graded No on presence until the bet is measured as an exceed

bound to runtime/_hdl_build/nx_pkg.nx:pkg_cas_resolve · measured PRESENT (decl) · CONSISTENT

PART

Probing + in-repo compiler fuzz/self-heal loop (fuzz gen, EMI oracle, splice bisector, native diagnostic-corpus gate, never-brick bless)

Found and named real nx_cc bugs (empty-.s class 2026-07-05; EMI oracle born catching a silent optimizer miscompile [emi2014]; gate 10/10 GREEN 2026-07-07); peers rely on external fuzzers (rustlantis, go-fuzz, csmith). PROBING IS NOW A NATIVE FIRST-CLASS CAPABILITY, not a pile of shell scripts (2026-08-14): nx_langdiag_gate runs the whole language-diagnostic probe corpus in NishiLang -- 11 rows GREEN through the shipped gate runner -- and it closed a real hole in how this estate had been testing refusals. The prior bash cells asserted only THAT a probe was refused (the emitted assembly was empty); a refusal for a COMPLETELY DIFFERENT reason passed them silently, which is the same blind-by-construction shape as a deny-test suite that never asks which rule fired. Every row now pins the refusal to its own rule phrase or capability slug, so a wrong-reason refusal is RED -- BITE-PROVEN by planting a slug the rule never prints, which yields exit=2 want_exit=2 with the reason mismatched, exactly the case the old cell passed. Acceptance rows (must compile AND emit real assembly) are the discrimination control: without them a compiler that refused every input would score full marks on the refusal rows. It composes the estate's incumbents rather than adding a ruler -- nx_gate_lib's fork-and-assert case runner for mechanics, nx_gate_verdict for adjudication (the promote door REFUSED the first build for rolling its own verdict, and migrating was taken over the documented override) -- and it reports a third state, UNRESOLVED, when the compiler under test cannot be found, because 'I could not look' is not 'it is broken'

bound to runtime/nx_cc_equiv_gate.nx:eq_build · measured PRESENT (decl) · CONSISTENT

BEST

Living bug-class ledger wired to language evolution

F1-F16 taxonomy + P1-P10 meta-patterns + 1651 external oracles classified into 26 ranked axes driving make-it-unrepresentable rungs; PLUS an AI-authoring friction lane (2026-08-13): full-population mining of the AI seats' own session transcripts (1,090 files / 2.88 GiB, counted not sampled) ranks which language defects burn agent tokens -- SEGV-class debugging 5,151 hits across 376 sessions, the paren-cast-index silent-truncation trap in 45 -- and the top-ranked reachable trap was root-caused, witness-gated and toolchain-promoted the same day; peers have public trackers, not ledgers wired to language change, and none wires AI-usage telemetry into language evolution; since 2026-08-13 night the loop is CLOSED IN THE COMPILER ITSELF AND COUNTED BY THE BUILD DOOR: capability-limit refusals stamp greppable capability=<slug> markers (float-int-boundary, call-arity-ceiling, memory-safety-enforcement) at the moment of friction, and /api/build now appends every marker to a DURABLE demand journal (knowledge/status/lang_demand.jrnl: epoch, slug, target; bounded 8/build, append-only, never fails a build -- live-bitten: one refused build wrote its 3 rows the moment it failed), so real demand re-ranks the climb with NO human in the circuit; the same session's refusal check also surfaced a 15-site latent parser gap (chained casts `X as *u8 as i64` were HALF-APPLIED forever, the dangler silently skipped) which is now a real chain, witness-gated

BEST

Sovereignty and determinism (the Nishi lane)

Whole-toolchain sovereignty (zero LLVM / GCC / libc beneath)

The chain nx_cc -> nxasm -> ELF is ours bits-up and compiles on the NAS over the mgmt API (build-over-API GREEN 2026-07-06); Rust/Zig/Swift sit on LLVM; Go owns its backend but links foreign substrate below

bound to runtime/nx_compile_x86.nx:func main(argc · measured PRESENT (decl) · CONSISTENT

BEST

No-float integer determinism doctrine (bit-exact cross-platform)

A 100 percent integer LLM trained + greedy-matches the float reference 4-for-4 (2026-07-09); gate-grounded across codec and compute censuses; no peer ships float-free determinism as language doctrine

bound to runtime/nx_nofloat_llm.nx:qmul · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

BEST

Byte-identical reproducible rebuild

Rebuild byte-identical dd1baff6 MEASURED 2026-08-04; Go reproducible-by-default (1.21+) is the bar; JVM/gradle and npm builds are not bit-exact by default

YES

Capability-secured toolchain ops (ocap least-authority, attenuate-only)

X-Nishi-Cap ocap tokens + fixed-arg pinning live-proven 2026-07-08; attenuate-only delegation audited in cap_consent.log; no peer language ships an ocap-gated ops surface

BEST

Verified compilation / translation validation

Nobody mainstream ships it (CompCert is a separate verified C compiler; RustBelt/miri are research); the eqsat engine is CONSUMED by the shipping pipeline since 2026-08-14 (opt_eqsat_pass rewrites real IR; nx_opt_eqsat_wire_gate 5/5 proves x-xor-x folds in the promoted compiler and x-xor-y survives; nx_opt_eqsat_oracle_gate 13/13 is a whole-domain differential check of the strength-reduction pass against the proven rule) [egg2021]; PART, not Yes: differential oracles and an equivalence net are checks, not a proof-carrying compiler, and CompCert-class verification is not claimed

bound to runtime/nx_opt_eqsat_pass.nx:opt_eqsat_pass · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Domain reach: one language, in the language (no add-on program, no second language, no foreign runtime), plus the doors and arenas it must reach

Exact arithmetic in the language: arbitrary-precision integers and rationals

Nishi has the organs (nx_bigint_lib, nx_rational) and not the notation: Part until LN83 makes them syntax; Python, Haskell, Julia and Lean carry unbounded integers natively; Zig and Go in the standard library; the field bar this month is FloatLib certified arbitrary-precision arithmetic inside Lean [floatlib-2609-19352]

bound to runtime/nx_bigint_lib.nx:bi_copy · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Symbolic algebra in the language: simplify, differentiate, integrate

Nishi has a symbolic integration engine and a Taylor series engine as organs (Part); every rival reaches symbolic algebra through a package (SymPy, Symbolics.jl, Ryacas) or a proof tactic; the bar is the parallel Risch-Norman integrator returning 49 of Charlwood 50 verified by differentiation [sympy-charlwood-2609-25616] The Mathematica 14.3 column was read from the vendor revision history on 2026-09-26 [mathematica-revisions-2026-09]; its cells are documented capability presence, hand-graded like every rival column.

bound to runtime/nx_calc_integrate.nx:nx_calc_integrate · measured PRESENT (exists) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Units and dimensional analysis typed in the language

Nishi has the SI units and dimensional-analysis organ (Part until LN83 makes a unit mismatch a compile refusal); rivals reach units through packages (uom, pint, Unitful, units); no column types them in the language

bound to runtime/nx_units.nx:nx_dim_new · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Tables in the language: dataframes, group-by, join and CSV

Nishi has a CSV renderer and a group-by shuffle as organs (Part); R data.frame is native (Best); Python pandas and Julia DataFrames.jl are packages; Go carries CSV in its standard library

PART

Statistics and econometrics in the language: least squares, panel and time series

No Nishi organ carries regression yet (LN84); R lm and glm are native (Best); Python statsmodels and Julia GLM.jl are packages [r-sources-2026-09]

Text in the language: sentence splitting, tagging and parsing

Nishi has the aspect lane tagger, sentence splitter and parser as organs (Part until LN85 makes them language values); Python NLTK and spaCy, R tidytext and Julia TextAnalysis.jl are packages; Swift ships NaturalLanguage in the platform SDK

bound to :pt_eval · measured UNRESOLVED · UNRESOLVED

PART

Chemistry in the language: molecule graph and SMILES

Nishi has the molecule graph, SMILES parser and SMILES emitter as organs (Part until LN86); Python RDKit, R ChemmineR and Julia MolecularGraph.jl are packages

bound to runtime/nx_chem_molecule.nx:nx_chem_mol_new · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Propositions as types with a checked proof kernel

Lean is the bar (Best): Iris and guarded recursion moved INTO Lean this month through its own metaprogramming [garlene-2609-24345]; Haskell carries a fragment (LiquidHaskell, dependent Haskell); Nishi has none (LN79)

Compile-time execution of the language itself

Zig comptime and Lean elaboration are the bar (Best); Rust const fn, C23 constexpr and Haskell Template Haskell are fragments; Julia generated functions and macros run at compile time (Yes); Nishi has none (LN76)

Notation extension elaborated in the language

Lean notation and macros are the bar (Best); Rust and Julia macros (Yes); Zig comptime, Swift macros, the C preprocessor, OCaml ppx, Template Haskell and R quote-eval are fragments; J subsumes NumPy broadcasting as notation this month [j-verb-rank-2609-16064]; Nishi has none (LN77)

The Kaggle door: a program runs inside the Kaggle notebook image and submits

The notebook image is the Colab runtime of 2026-07-16 with Python 3.12, gcc and CUDA and no Rust, Julia or wasm runtime [kaggle-docker-python-2026-09]: Python and R are native kernels (Best), C compiles in the notebook (Yes), Rust, Zig, Go and Julia need an in-notebook toolchain install (Part); Nishi enters as a static ELF the notebook executes (LN87)

The sensor door: the same source builds for a microcontroller-class target under a never-brick classifier

C is the bar (Best); Rust no_std and Zig freestanding reach microcontrollers (Yes); Go through TinyGo, Swift through Embedded Swift and Python through MicroPython (Part); Nishi has RV64 and x86-64 doors and MCU kernels but no MCU compiler door (LN91); LispBM is the month witness for a sensor program growing past its heap [lispbm-2609-23009]

The GPU door: kernels from the same source

Julia CUDA.jl compiles Julia kernels (Yes) and C reaches the GPU through CUDA C (Yes); Rust and Zig through SPIR-V or CUDA crates, Python through Triton (Part); the frontier this month verifies kernel determinism in the compiler [gpu-bitwise-2609-11356] and compiles tile programs tuning-free [schedules-symbols-2609-29219]; Nishi emits WGSL text for the browser but no kernel door from the same source (LN75)

The quantum and photonic door: a hybrid quantum-classical dialect lowered as data

Python and Julia reach quantum hardware through libraries (Qiskit, PennyLane, Yao.jl: Part); no column carries a quantum or photonic door in the language; the frontier is hybrid and dynamic with gates as first-class IR values [quantum-dynamic-ir-2609-01037] and a formal continuous-variable semantics for photonic hardware [cvqc-verif-2607-17714]; Nishi has none (LN92, LN93)

The zero add-on count: foreign programs a workflow shells out to, measured on a beat

Nishi measures it daily (nx_lang_addons, LN80) and the count is not yet zero (Part); no rival toolchain counts its own add-ons, so every rival column reads No on the measurement, not on the add-ons

bound to runtime/nx_lang_addons_lib.nx:la_addon_census · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

15 competitors50 axes4 quantitativeNishi best 6 · absent 13bound 26 · stale-under 0 · unbacked 0 · unserved 18

Honest verdict. NishiLang is a real self-hosted systems language with a self-healing compiler loop and five structural exceeds no peer carries: whole-toolchain sovereignty bits-up, no-float bit-exact determinism proven at LLM scale, an in-repo fuzz+EMI+bisector loop, a 1651-bug external-oracle ledger wired to language evolution, and an ocap-secured ops surface. It is not yet a peer of Rust, Swift, or Elm on enforced safety, speed or the tooling ring: overflow (LN1 --chkarith, 2026-08-23), null (LN2 --optenforce, 2026-08-23), raw-pointer provenance (LN3 --ptrprov, 2026-08-19) and ownership plus use-after-free (LN4-LN5 --ownership, 2026-08-25) are enforced only under DECLARED MODES that default OFF, typed arrays are checked by default, and there is no race enforcement at all; the tooling ring now EXISTS -- LSP (2026-08-25), formatter (2026-08-23), incremental cache (2026-08-25), statement stepping (2026-08-25), each gate-proven and each BOUND on this page to its symbol and re-measured on every publish -- but none is yet at the top of the adoption ladder; and the sovereign head-to-head receipt (2026-09-01, promoted toolchain, every arm on one checksum) measures the checked hot loop at 3.33x gcc -O2 and 1.6x Rust-checked, so on speed it is behind and says so with the receipt rendered below (debug INFO, however, is no longer absent: opt-in DWARF v5 .debug_line at function granularity landed 2026-08-07, gate-proven end-to-end and readable by GNU readelf); arity, exhaustiveness (naming missing variants), unreachable-arm refusal, caret + did-you-mean (calls AND identifiers), and multi-error recovery are ENFORCED sovereign-side as of 2026-08-05, each bite-witnessed refuse+accept on the live compiler. Under the less-than-SOTA-is-never-design law every No is filed work: measured demand (1651 oracle bugs) ranks miscompile-detection (638), vectorization (78), and poison/undef semantics (54) first. Discipline: the equivalence net is GREEN (nx_cc_equiv_gate 10/10 + selfhost, re-run 2026-08-13; standing rule: every compiler change passes it before promotion) and the loop now also eats traps mined from AI-seat usage: the paren-primary silent-truncation class -- ("lit" as *u8)[j] compiled clean, silently dropped the index, and left the pointer truncated in the receiver -- was ranked by a full-population scan of 1,090 session transcripts (2.88 GiB; the trap shape appears in 45 sessions), fixed in parse_primary (postfix chain now runs after a parenthesized primary, the same seq1552 class the string-literal path already carried), mutation-proven (gauntlet 32/32 under the fixed compiler, the pre-fix compiler RED on exactly the new cell), and toolchain-promoted canary GREEN 2026-08-13 with the leading-operator statement-break trap pinned CCFAIL in the same gauntlet; the SECOND 08-13 promotion closed the trap's leading-MINUS variant for good -- a continuation line starting with a unary-capable operator used to parse as a separate DISCARDED statement (the 2026-05-19 cross-product wrong-value shape, alive and measured exit-7 that morning) and is now refused by a discarded-pure-expression check in the statement fallback [SUPERSEDED 2026-08-25 BY LN15 tok_line_continuation, recorded 2026-09-02: a continuation line opening with a binary operator now JOINS the expression above it instead of being refused -- nx_linecont_gate 10/10 GREEN on the promoted toolchain proves the joined forms compute (det2x2 fixture, plus, minus, ampersand, star-when-no-store) while a lone operator with nothing above it and the unary-only prefixes still REFUSE; the discarded-pure-expression check stands on its irreducible witness nx_probe_lone_operator, and nx_langdiag_gate, which read RED 9/11 for a week because its two multi-line witnesses had become correct programs, was re-pointed to that contract the same day (debt 1788309098)] (provably-pure roots only, so call and syscall statements stay untouched -- the first cut wrongly refused a bare __syscall and was inverted per the fail-toward-doing-nothing law), speaking the 5W+H voice with file:line, caret, why and fix; equiv net 10/10+selfhost GREEN twice, gauntlet 33/33 with both must-refuse cells and the estate is MEASURED arity-clean (9-target backfill sweep, 56 closure files, ~1625 functions, 0 mismatches incl the compiler's own 692-function closure) -- so the enforcement climb has crossed its diagnostics rungs (arity, exhaustiveness, caret+DYM, multi-error recovery); per-file line mapping and function-granularity DWARF are now CLOSED (nx_dwline_e2e_gate 14/14 + nx_dwline_roundtrip_gate 13/13, 2026-08-07); open: the safety ring, .debug_info (types/variables) and a stepping debugger, regalloc-on-x86, then the tooling ring (LSP, formatter, incremental, stepping debugger). RUNTIME CRASH DIAGNOSTICS rung 1 SHIPPED 2026-08-13: a SIGSEGV/SIGBUS/SIGILL/SIGFPE in a guarded program now prints the instruction address and the fault address in the same 5W+H voice and STILL dies by the ORIGINAL signal (wait-status unchanged) -- one call arms it (nx_crash.nx), the toolchain's own binaries (nx_cc + nxasm) ship armed, the handler ABI and signal-frame offsets are witness-proven by an exact planted fault address (nx_probe_crash_live.nx derefs address 64 and the diagnostic prints 0x...40), and the armed toolchain is proven inert by byte-identical emitted artifacts; this rung was ranked FIRST by the AI-transcript mine (5,151 silent-SEGV hits across 376 sessions -- the largest language-attributable token burn). BOTH named follow-ons SHIPPED the same afternoon: the guard is now DEFAULT-ON for every compiled main (driver-append + parser-inject, --no-crash-guard opt-out, +4.9 KB measured, equiv corpus run-behavior byte-equal) and stack-overflow crashes speak through a 32 KiB sigaltstack with a classifier that names UNBOUNDED RECURSION; remaining: in-process file:line resolution against .debug_line. Climb ledger: debt lane lang-radar-climb-program.

Honest verdict. NishiLang is a REAL self-hosted systems language — sovereign compiler, generics, sum types, two native backends, wasm, and a compiler self-healing loop (fuzz generator + EMI oracle + bisector + never-brick bless) that most toolchains do not carry in-repo. It is <b>not</b> yet a peer of Rust, Zig, Go, or Elm on the axes the public bug dumps say matter most: no memory-safety enforcement, no arity or exhaustiveness checking, no rich diagnostics in the shipping compiler, no LSP, and measured 3.65x slower than gcc -O0. The two genuine <b>exceeds</b> are structural: the whole toolchain is ours bits-up, and the no-float integer-determinism doctrine is proven at LLM scale. The climb: safety checks the language can enforce, the diagnostics port, regalloc on x86-64, and the tooling ring (LSP, formatter, incremental builds).

Measured head-to-head — a receipt, not a claim

Bounds-checked hot loop: NishiLang modes vs gcc, clang, rustc and go. sum a [1024]i64 array 20000 times through a runtime index (20,480,000 array reads); every arm prints elapsed_us= and checksum= and the checksum must be 31447040000 on every arm or that arm is VOID. The C arms are unchecked by the language; the Rust arm indexes with [] so its bounds checks are in play; the Go arm is bounds-checked by the language; every NishiLang arm keeps typed-array bounds checks LIVE and the mode arms add the declared bundles from knowledge/lang_modes.conf (f1 and drag elide only the checks the loop guard proves; daily and checked also enable every safety mode). From 2026-09-28 the f1 and drag arms carry the LN19 reduction vectorizer (the accumulate loop becomes SSE2 packed adds); --no-vecred is the switch-off control. Measured on west-laptop|Intel(R) Core(TM) Ultra 7 255HX|Linux 6.6.87.1-microsoft-standard-WSL2|nproc=16 on 2026-09-28 (unix 1790607364), 7 runs per arm, reference arm c-clang-O2 = 1.00x. Every arm had to print the same checksum or its row is VOID and never ranked; an arm whose toolchain is not declared on the host is UNMEASURABLE, an absence rather than a loss. Written by nx_lang_h2h, re-derived here by nx_bench_receipt_lib: reader verdict VALID, writer wrote VALID (writer and reader agree).

Arm	Toolchain	Version	Median µs	Min µs	vs reference	Checksum	Status	Runs	Source sha256	Binary
c-gcc-O2	gcc -O2 (bounds unchecked by the language)	`gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0`	2085	2055	1.90x	31447040000	VALID	7	`897978f2b047`	`c1ecef44f793` 16128 B
c-clang-O2	clang -O2 (bounds unchecked by the language)	`Ubuntu clang version 18.1.3 (1ubuntu1)`	1094	1092	1.00x	31447040000	VALID	7	`897978f2b047`	`10d60f5d0821` 16096 B
rust-O-checked	rustc -O (indexing with [] keeps the bounds checks in play)	`rustc 1.96.0 (ac68faa20 2026-05-25)`	8242	4316	7.53x	31447040000	VALID	7	`9f733cec5a7f`	`f4f893c5d6de` 4347064 B
go-build	go build (bounds checked by the language)	`go version go1.22.2 linux/amd64`	4132	4112	3.77x	31447040000	VALID	7	`bc90d704e03a`	`3d4bb605068b` 1917468 B
nishilang-default	nx_cc_sovereign + nxasm_x86_main (default build, typed-array bounds checks LIVE)	`nx_cc_sovereign sha256=d0304a3e908d34d0e2ca9d526afbb13afa887f5fa40949b75765f7ed07121581 bytes=913931; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	7077	7049	6.46x	31447040000	VALID	7	`b3c398ba3e41`	`10ae3f19f7b9` 15807 B
nishilang-checked	nx_cc_sovereign --mode=checked + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=d0304a3e908d34d0e2ca9d526afbb13afa887f5fa40949b75765f7ed07121581 bytes=913931; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	10554	10512	9.64x	31447040000	VALID	7	`b3c398ba3e41`	`2f2756a0acbe` 26655 B
nishilang-daily	nx_cc_sovereign --mode=daily + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=d0304a3e908d34d0e2ca9d526afbb13afa887f5fa40949b75765f7ed07121581 bytes=913931; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	10544	10509	9.63x	31447040000	VALID	7	`b3c398ba3e41`	`f7bb438b525a` 29960 B
nishilang-f1	nx_cc_sovereign --mode=f1 + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=d0304a3e908d34d0e2ca9d526afbb13afa887f5fa40949b75765f7ed07121581 bytes=913931; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	975	964	0.89x	31447040000	VALID	7	`b3c398ba3e41`	`3cb18aeba5c9` 15778 B
nishilang-drag	nx_cc_sovereign --mode=drag + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=d0304a3e908d34d0e2ca9d526afbb13afa887f5fa40949b75765f7ed07121581 bytes=913931; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	799	788	0.73x	31447040000	VALID	7	`b3c398ba3e41`	`5f4c2fc0be04` 9629 B

bench arms=9 valid=9 void=0 unmeasurable=0 build_fail=0 run_fail=0 unknown=0 (partition sums) verdict=VALID

reproduce:

cd /mnt/c/Users/elder/nishi-core/nxc2 && ./_build/nx_lang_h2h.sov.elf knowledge/bench/lang_h2h_ln19.conf

receipt: knowledge/compare/lang.bench · a rerun on the same host that changes the ranking is a finding, not noise; a rerun on a different host is a different receipt and says so in its host line.

Superiority scorecard — every axis, every rival, one verdict

Superior is a number, or it is not written. One row per rival per axis, read from the receipt knowledge/compare/lang.scorecard written by nx_lang_scorecard and re-derived here by nx_scorecard_receipt_lib. Rival cells as of 2026-07. Verdict NOT-SUPERIOR: the word is written only when every row reads WIN against a named current version; every LOSE row is the work order and the receipt names its axis. The axis rows are counted below with their partition re-derived beside the total, then tallied per rival.

Scorecard rows, counted
Class	Count	Note
rows	714	one row per rival per axis with a readable verdict
win	226	the estate reads WIN on that axis against that rival
lose	212	the work order: the receipt names the axis
tie	212
unmeasured	64	no measurement yet on that axis
rows, summed	714	RECONCILED: the parts sum to the total 714
malformed	0	counted, never rendered, outside the row total

Rival	Win	Lose	Tie	Unmeasured
Rust	14	22	12	3
Zig	15	13	18	5
Go	15	20	13	3
Swift	15	16	15	5
Kotlin	15	13	18	5
TypeScript	17	11	18	5
Python	15	15	16	5
C	27	8	13	3
Elm	17	12	17	5
OCaml	15	15	16	5
Haskell	14	18	14	5
Julia	15	17	14	5
R	18	11	17	5
Lean	14	21	11	5

Leaderboards — the estate's row placed by arithmetic

Public boards as data: every published entry is read from a mirrored, pinned copy of the board; the estate's own rows are written only by the measuring organ. The rank shown for the estate is recomputed here from the scores (one plus the rivals strictly above; a tie ranks with the tied), never copied from the file, and the leap is the move since the estate's earliest measurement.

Board: h2h-accumulate · metric: million element reads per second on the head-to-head accumulate loop (20480000 reads, checksum 31447040000, one host, min of 7 runs, every rival run beside the estate); higher is better · source: https://nishifamily.com/compare/lang · mirror knowledge/compare/lang.bench pin h1f4c48cbb8b7ecf6dae37e9d47368e059e6cc04958ce74f583e66becd49c043f fetched 2026-09-28

Rank	System	Organisation	Score	Date	Entry
1	clang -O2	LLVM (Ubuntu clang 18.1.3)	18754.6	2026-09-28	entry
2	gcc -O2	GNU (gcc 13.3.0)	9965.9	2026-09-28	entry
3	go build	Go (go 1.22.2, bounds checked by the language)	4980.5	2026-09-28	entry
4	rustc -O (checked indexing)	Rust (rustc 1.96.0, bounds checks in play)	4745.1	2026-09-28	entry
4 (computed)	nishi-lang-f1	Nishi (f1 mode before LN19, toolchain c18411d5, lang_jo.bench)	4918.3	2026-09-28	entry
1 (computed)	nishi-lang-f1	Nishi (f1 mode with the LN19 packed reduction, toolchain 304d0f5d, laptop-lane twin d0304a3e)	21244.8	2026-09-28	entry
1 (computed)	nishi-lang-drag	Nishi (drag mode with the LN19 packed reduction and no crash guard, the benchmark lane)	25989.8	2026-09-28	entry

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/lang.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain lang, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from lang.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	3
scanned	3
fetched	3
reused	0
failed	0
named	3
candidates	3
mentions	3
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Rust	1	1	col0-rust	named	https://doc.rust-lang.org/book/ch04-00-understanding-ownership.html
2	Zig	1	1	col1-zig	named	https://ziglang.org/download/0.15.1/release-notes.html
3	Elm	1	1	col3-elm	named	https://elm-lang.org/news/compiler-errors-for-humans

Gauges — a heartbeat, never a bare number

Each row names a gauge stamp written by its measuring beat. This page re-judges the stamp on every publish with the same ruler the beat uses (nx_gauge_lib): FRESH shows the value; STALE withholds it (older than two beats); BLIND withholds it (an axis abstained); ABSENT means nothing has measured. A stale gauge never reads as zero.

gauge	state	reading	note
Research watch: radar banks left stale or unfetched by the last refresh (LN121)	FRESH	FRESH gauge=0 axes=1/1 age_s=424247	written by nx_swcompare_research on the langradarbank clock row; the row passes its own interval as the staleness bound, so a bank is stale when it is older than the beat that refreshes it. gauge = banks whose refresh failed and kept their previous generation, plus banks whose first fetch failed; 0 means every bank this board's .q names is no older than one beat. First production run 2026-10-03: banks=20 refreshed=7 first=13 kept_stale=0 failed=0 and the seven June banks were replaced with the previous generation kept beside them as .txt.prev
Research watch: proposals filed by the last scheduled scan (LN121)	FRESH	FRESH gauge=34 axes=9/9 age_s=13280	written by nx_frontier_scan propose lang on the langpropose clock row. One pass asks 6 of the board's 128 seeds (42 deficit rows and 86 watch keywords) and a cursor rotates the start, so the whole population is asked in about five days at this cadence. gauge = proposals that pass filed; axes = sources that answered of the sources in this board's scope, so an unanswered source reads BLIND and a count is never shown from a partial listen. First scoped run 2026-10-03: 8 of 8 sources answered, 48 fetches, 2 proposals; the unscoped run before it filed 14, and 13 of the 14 were off-subject when their records were read (the one on-subject find was a GitHub repository)
Differential run: seeds whose two compiler builds disagree by their last row (LN100)	FRESH	FRESH gauge=0 axes=1/1 age_s=531	written by nx_progen_diff after every slice of the progendiff clock row, which now runs detached so the clock's dispatcher is free. gauge = distinct seeds whose two builds DISAGREE: zero is the healthy reading and any other number is a compiler finding to work. The axis is observed only when the ledger read back whole and the slice ended DONE or out of its beat's budget; a full disk, a refusal run or a refused ledger reads BLIND, never a clean zero. A slice that finds the lease busy writes nothing, so a holder that never finishes shows as STALE

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 150 capabilities: 142 exclusive to it and 8 shared with other boards. Shared rows on this page: 8 = home here 1 + home elsewhere 2 + ambiguous 0 + undecided 5 + refused 0 (partition 8); undecided = unmapped 0 + unproven 5 + unevidenced 0; homonyms 2; since the previous census: new 0, resolved 0. Census FRESH age_s=44.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
nx_calc_integrate	`nx_calc_integrate.nx`	stem, lang, computational	—	none	unproven	undecided
qmul	`nx_nofloat_llm.nx`	llm*, lang, modelwright	llm	rung	plan	home elsewhere adopt: `@xrow llm\|qmul\|home by rung (fleet duplicate census)`
ep_read	`nx_energy_probe.nx`	browser, lang	—	none	unproven	undecided
func main(argc	`-`	lang:runtime/nx_compile_x86.nx, lang:runtime/nx_compile_x86.nx, janitor:runtime/_hdl_build/nx_secret_scan.nx	—	homonym	-	homonym
wat_emit_module	`nx_wasm.nx`	lang, gameengine	—	none	unproven	undecided
wat_emit_module	`-`	lang:runtime/nx_wasm.nx, gameengine:runtime/nx_wasm.nx, sovereignty:runtime/wasm.nx	—	homonym	-	homonym
sp_atoi	`nx_shapeprobe.nx`	lang, doctor	—	none	unproven	undecided
sb_try_franken	`nx_cc_splice_bisect.nx`	lang, doctor*	doctor	rung	plan	home elsewhere adopt: `@xrow doctor\|sb_try_franken\|home by rung (fleet duplicate census)`
run_argv	`nx_cc_health.nx`	lang, doctor	—	none	unproven	undecided
dbg_step_over	`nx_dbg_step.nx`	lang+, doctor	lang	rung	plan+gates	home here

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396491 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_rvc_gate`	lang	plan-queue	rung=LN9
directive	`nx_dangling_else_gate`	lang	plan-queue	rung=LN30
directive	`nx_dev_pipeline_test`	lang	plan-queue	rung=LN31
directive	`nx_team_roster`	lang	plan-queue	rung=LN31
directive	`nx_andelinwest_build`	lang	plan-queue	rung=LN31
directive	`nx_vcodec_neural_entropy_gate`	lang	plan-queue	rung=LN31
directive	`nx_crash_guard`	lang	plan-queue	rung=LN30
directive	`nx_wasm_memory64_req`	lang	plan-queue	rung=LN35
directive	`nx_net`	lang	plan-queue	rung=LN41

rows shown 9|this board's directives 9|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rust-ownership] The Rust Project. The Rust Programming Language, chapter 4: Understanding Ownership (ownership, borrowing, and the borrow checker). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rust-ownership.html · pin hb000ae040981e3d15a775e11c6d3567c41967e375d70f7346de8654764f8477a · accessed 2026-08-18 · vendor-docGrounds: The Rust column: Memory safety (bounds, ownership, use-after-free) Best, Use-after-free prevented (CWE-416 class) Best and the lang.sota Compile-time memory safety enforcement Best -- the borrow checker is the bar the own_check_move and own_check_uaf watch contracts are measured against.
[zig0151] Zig Software Foundation. Zig 0.15.1 Release Notes: self-hosted x86 backend default for Debug builds on x86_64, async and await keywords removed pending the std.Io redesign, module-level UBSan modes, zig fmt auto-upgrade. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_zig0151.html · pin h9de868b1d922477b725d3bdb7229ba672801c0aa28dde239c60379dccf3d6963 · accessed 2026-08-18 · vendor-docGrounds: The Zig column and the BARS line (Zig 0.15.1, 2025-08-29): lang.sota Native backends in one shipped toolchain (Zig 0.15 ships its self-hosted x86 backend), Lightweight concurrency (Zig async dropped in 0.15 pending redesign), Integer overflow checked (Zig safe-mode) and Canonical source formatter (zig fmt).
[go118] The Go Authors. Go 1.18 Release Notes: generics (type parameters, type sets), fuzzing in the standard toolchain, workspaces. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_go118.html · pin h3196a875d7e52f2fd6b5726e41f0a614c56906f7b446f27b5df788025b7d2af8 · accessed 2026-08-18 · vendor-docGrounds: The Go column: Generics + monomorphization (Go added generics in 1.18; lang.sota Go type sets since 1.18) and the go-fuzz lineage the In-repo compiler fuzz generator row names as an external fuzzer.
[elm-errors] Czaplicki, E. Compiler Errors for Humans (Elm 0.15.1 announcement, elm-lang.org news): line-cited errors, source excerpts, hints and did-you-mean suggestions. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_elm-errors.html · pin h312d098809ea8a53bf3b337b5e423b8f806d21a9098b1f17b7cafe66a37dab8d · accessed 2026-08-18 · vendor-docGrounds: The Elm column Best on Rich diagnostics in the shipping compiler (caret, did-you-mean, multi-error) and lang.sota Compiler diagnostics: this is the Elm-class voice the 5W+H undefined-name family and the caret + did-you-mean rungs are graded against (Elm and rustc remain the bar on error codes and explain prose).
[cisa-memsafe] CISA, NSA, FBI and partners. The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously (December 2023). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_cisa-memsafe.html · pin hf9d24a5023c144a32eee09e53ddf961809518206cc1419b6b817547a15ef6ede · accessed 2026-08-18 · published-standardGrounds: The PUBLIC BUG DUMPS line (bug_cisa_memsafe, banked 2026-07-10) and every CWE-class safety row: Bounds-checked access (CWE-787 and CWE-125), Raw-pointer access prevented, Use-after-free (CWE-416), Integer overflow (CWE-190) -- the roadmap is why those classes head the safety ring and why the memory-safety gap is graded the largest on this board.
[emi2014] Le, Afshari, Su. Compiler Validation via Equivalence Modulo Inputs. PLDI 2014 (Distinguished Paper Award). EMI project page with the paper and the GCC/LLVM bug tally. publisher · read in our library knowledge/fetched/cmp_lang_emi2014.html · pin hd6ed16853f6aa9fe7071cfcce27bf5f3cd9ff49c3a4bb7f7f142ec6e3ff8e0a6 · accessed 2026-08-18 · published-paperGrounds: The Differential EMI oracle on the compiler gate row and the lang.sota Probing + in-repo compiler fuzz/self-heal loop cell: nx_cc_equiv_gate is the EMI method (equivalent programs must build and run byte-equal) applied in-repo, born catching a silent optimizer miscompile.
[egg2021] Willsey, Nandi, Wang, Flatt, Tatlock, Panchekha. egg: Fast and Extensible Equality Saturation. POPL 2021. arXiv:2004.03082. publisher · read in our library knowledge/fetched/cmp_lang_egg2021.html · pin he3bed05ebf48a84fb260752a3dbb1b8a98a8dec8fc03c72ea9c1573d5b0259df · accessed 2026-08-18 · published-paperGrounds: The Equality-saturation engine row and the opt_eqsat_pass watch contract: nx_eqsat's egg-style deferred congruence closure (rebuild) and e-class analyses (const-fold) are this paper's design, and the Verified compilation / translation validation cell names eqsat as the wired-next oracle.
[poletto1999] Poletto, Sarkar. Linear Scan Register Allocation. ACM Transactions on Programming Languages and Systems 21(5), 1999. publisher · read in our library knowledge/fetched/cmp_lang_poletto1999.html · pin h9cd2d89cf54ac5c10d78bd80a21a99c466f306490ea90cdb19ebd77ae9587349 · accessed 2026-08-18 · published-paperGrounds: The RISC-V target row (the linear-scan allocator nx_regalloc, Poletto-Sarkar, is wired there) and the Competitive native speed vs C row: the x86_use_regalloc watch is about consuming the allocation this algorithm already computes.
[stabilizer2013] Curtsinger, Berger. STABILIZER: Statistically Sound Performance Evaluation. ASPLOS 2013. publisher · read in our library knowledge/fetched/cmp_lang_stabilizer2013.pdf · pin h819c930cc8f51a65a24cdc46452a29ec2c872391724974d21589a8729dac9c49 · accessed 2026-08-18 · published-paperGrounds: The BARS line perf bar (gcc -O0 Stabilizer-validated, bench/paired_native_microbench.tsv 2026-05-20) and the lang.sota Native speed vs C row: the 3.65x figure is a Stabilizer-style layout-randomised comparison, which is why it and the 2026-08-14 h2h numbers are declared different benchmarks and neither refutes the other.
[oncd2024] Office of the National Cyber Director, The White House. Back to the Building Blocks: A Path Toward Secure and Measurable Software (February 2024). Technical report PDF. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_oncd2024.pdf · pin h3244ac0dd424bde0b23a63ec904787d0163951154d0ae546ce683a18e85d9eeb · accessed 2026-08-19 · published-standardGrounds: Memory safety (bounds, ownership, use-after-free) and the safety-ring watch rows (own_check_move, own_check_uaf, bck_ptr_provenance) plus the lang.plan memory-safety-mandate bar: the White House report that made memory-unsafety a national-security finding.
[regehr-ub] Regehr, J. A Guide to Undefined Behavior in C and C++, Part 1. Embedded in Academia blog. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_regehr-ub.html · pin h93435da7091bce40980326e965f50a34b3cdd7e53e29f358dab6b20e0b28dc4d · accessed 2026-08-19 · vendor-docGrounds: Integer overflow checked (CWE-190 class) and the lang.sota UB / poison semantics cell: the canonical statement of silent UB as a miscompilation engine -- the negative bar the refusal-with-reason lane answers, cited by the lang.plan UB bar.
[rustperf2025] The Rust Project. Rust Compiler Performance Survey 2025 Results (September 2025): 55 percent of respondents wait over 10 seconds for an incremental rebuild. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rustperf2025.html · pin h732adfe07406baa416bd46d62201a1214ef37e27d5a2ba22c7e3075a23b420b0 · accessed 2026-08-19 · vendor-docGrounds: Incremental compilation / build cache and the lang.plan adoption-tax bar: the measured compile-latency tax that toolchain.plan B-rungs and the inc_cache_lookup watch exist to refuse.
[rustsurvey2025] The Rust Project. 2025 State of Rust Survey Results (March 2026): community-measured complexity worry and adoption blockers. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rustsurvey2025.html · pin ha6701ab12caecdbdd442d43499a831f65d88a8ab19569ba0955663fd01c9bd5e · accessed 2026-08-19 · vendor-docGrounds: The lang.plan adoption-tax bar and complexity-creep risk: the Rust community's own measured fear that the language grows too complex -- the control group for every annotation NishiLang declines to add.
[tob-supply2025] Trail of Bits. Supply chain attacks are exploiting our assumptions (September 2025): the npm worm record and install-time execution as the root enabler. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_tob-supply2025.html · pin h36a1f2e54ba32c23659dd086647eb6ae8b4cd032673ffbf9a03f393230ac6d1d · accessed 2026-08-19 · vendor-docGrounds: Supply chain by construction (no install scripts, content-addressed, no registry attack surface): the 2025 registry-worm record that makes the zero-install-script content-addressed bet worth measuring as an exceed (pkg_cas_resolve).
[midori-errors] Duffy, J. The Error Model. Midori project retrospective, joeduffyblog.com (February 2016). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_midori-errors.html · pin h0d1f12fe40b8a80fc45663a6e1d12531f65406f9d9ecedbef4162f551079a7c3 · accessed 2026-08-19 · vendor-docGrounds: Errors as values with enforced propagation (the Midori model): typed recoverable errors plus fail-fast abandonment -- the design bar for the res_propagate_op watch and the lang.plan errors bar.
[go-errsyntax] Griesemer, R., for the Go team. On or No syntactic support for error handling (go.dev blog, June 2025): Go closes all error-handling syntax proposals. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_go-errsyntax.html · pin h5d9402af993a26016b3826877d0e4640b363ab2f683247e2bba2c58a0f51796c · accessed 2026-08-19 · vendor-docGrounds: Errors as values with enforced propagation (the Midori model): the 2025 proof that error ergonomics cannot be retrofitted once a community standardizes on the boilerplate -- why rung E1 ships while the corpus is still ours.
[njs-nursery] Smith, N. J. Notes on structured concurrency, or: Go statement considered harmful. vorpus.org (2018). URL witnessed 2026-08-19; vorpus.org refuses the sovereign fetch lane (TLS handshake class), mirror declared absent. publisher · accessed 2026-08-19 · vendor-docGrounds: Structured concurrency (scoped spawn, no orphan tasks): the founding nursery essay -- spawn only inside a scope that joins its children -- the design bar for the sc_scope_spawn watch.
[nystrom-colors] Nystrom, B. What Color is Your Function? journal.stuffwithstuff.com (February 2015). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_nystrom-colors.html · pin h2958fb04a0a37663c1ac992843a4d89f3460326eb203356134894a532f6cd728 · accessed 2026-08-19 · vendor-docGrounds: Structured concurrency (scoped spawn, no orphan tasks) and the lang.sota Colorless functions cell: the colored-function essay naming the async split NishiLang avoids by construction.
[rule-of-2] Chrome Security Team. The Rule of 2. Chromium in-tree security documentation. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rule-of-2.html · pin hc65a1ed50b0bf606c7331a3ffc9060dad0919ccc9af4cebc9f5793415ed52eb8 · accessed 2026-08-19 · vendor-docGrounds: Safety ring inherited by NishiOS + Nishi Browser (the Rule-of-2 discharge): the browser bar -- untrustworthy input, an unsafe language and high privilege may never combine -- that the nxos_lang_ring_attest watch discharges by measurement.
[ferrocene] Ferrous Systems. Officially Qualified: Ferrocene (TUV SUD qualification of the Rust toolchain, ISO 26262 and IEC 61508). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_ferrocene.html · pin h47438da624dbe83ea88bf196ac969406cf5e5ff860e41834fe346b9e1b6dfec0 · accessed 2026-08-19 · vendor-docGrounds: Written language specification + conformance suite: Rust reached safety-critical qualification only by retrofitting a written spec -- the certification floor the spec_conformance_run watch takes early.
[austral-caps] Borretti, F. Austral tutorial: Capability-Based Security (linear capabilities; authority is a value, never ambient). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_austral-caps.html · pin h0c81921773cac8d9d060ebf0b5bf2dd44dbe56edbafe0dd8aebf9a53939c722f · accessed 2026-08-19 · vendor-docGrounds: Language-level capability security (no ambient authority): the linear-capability design where authority is handed to main and a dependency signature IS its permission manifest -- the bar for the cap_root_main watch.
[matklad-ide] Kladov, A. (matklad). Next Few Years. rust-analyzer blog (May 2020): the IDE-first query-architecture argument. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_matklad-ide.html · pin h9d10fcd196d73d19edfd58e755f3ee65311247a0fb609327257c58655a88465b · accessed 2026-08-19 · vendor-docGrounds: Language server / editor integration: the IDE-first bar -- the lsp_serve watch consumes the compiler's own front-end, never a second parser.
[llvm-irce] LLVM Project. InductiveRangeCheckElimination.cpp -- the IRCE pass that splits a loop into pre, main and post loops so the main loop provably needs no range checks (header comment). Source read from the mirrored file. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_llvm_irce.cpp · pin h5ec2cdfaf42e112cdb195f98ef6cdad06189177de22682f646e193e620a22bb3 · accessed 2026-09-01 · source-readGrounds: Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop)
[go-prove] Go Authors. cmd/compile/internal/ssa/prove.go -- the prove pass with per-value Limit{Min,Max,Umin,Umax} lattices used to remove bounds checks. Source read from the mirrored file. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_go_prove.go · pin he9d0e71a2d91deb363ab65e0a9da7480929d76cd607f021edaf3cfe8cceb65e5 · accessed 2026-09-01 · source-readGrounds: Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop)
[llvm-vectorizers] LLVM Project. Auto-Vectorization in LLVM: the Loop Vectorizer and the SLP Vectorizer (llvm.org/docs/Vectorizers.html). Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_llvm_vectorizers.html · pin h5928cd2813ff9510440b844efb73cc1c56c57472e0a3806e7fc4120e80d61b06 · accessed 2026-09-01 · vendor-docGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-autoveccoder-2026] Li, S., Yin, X., Jin, X., He, Y., Zhou, Y., Li, Y., Han, X. AutoVecCoder: Teaching LLMs to Generate Explicitly Vectorized Code. arXiv 2605.17978, submitted 18 May 2026 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2605.17978.html · pin h1e05cf26b477a6b8e39f2c83190918ce1e5133285b5830c7b82d0a25e553d57e · accessed 2026-09-01 · published-paperGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-nanokernels-2025] Thangamani, A., Shahid, M. A. A., Siemieniuk, A., Morel, R., Golin, R., Heinecke, A. Library Liberation: Competitive Performance Matmul Through Compiler-composed Nanokernels. arXiv 2511.13764, submitted 14 Nov 2025 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2511.13764.html · pin h4b329a93f1dfa0a37cf56b2b73b291ab09f36e7d016d455e4d5fa9aedf7688c1 · accessed 2026-09-01 · published-paperGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-eggmind-2026] Yin, C., Xiao, Y., Luo, Y., Zou, Y., Liang, Y. LLM-Guided Strategy Synthesis for Scalable Equality Saturation (EggMind, EqSatL). arXiv 2604.17364, submitted 19 Apr 2026 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2604.17364.html · pin h3c6cdfc012418e01b734bfebb727b971594ed5ceb1d666e64139913dfe6f1241 · accessed 2026-09-01 · published-paperGrounds: Equality saturation CONSUMED by a backend
[arxiv-autovec-list-2026] arXiv. Search listing: auto-vectorization compiler, newest first, as retrieved 1 September 2026 (the dated index the vectorization survey was drawn from). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_autovec_2026.html · pin h3c9b5e2ab2e05eb3b1e61cd86a29619b9b945d82ae48ed0a09d17dfbe27c5a53 · accessed 2026-09-01 · mirrored-indexGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-eqsat-list-2026] arXiv. Search listing: equality saturation vectorization, newest first, as retrieved 1 September 2026. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_eqsat_vec_2026.html · pin he3b2a8b48799afce47f847547909334c390c981a368dca3011fbf1effdfb7b9a · accessed 2026-09-01 · mirrored-indexGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[energy-languages] Pereira, R. et al. Energy-Languages (greensoftwarelab): the RAPL-instrumented CLBG harness behind Energy Efficiency across Programming Languages (SLE 2017) -- repository README read from the mirror. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_energy_languages_readme.md · pin h3cfb5612f10b49b78944e92c50bc7bdaf9bdf9940417f8c41b82bfad7ac2e74e · accessed 2026-09-01 · vendor-docGrounds: Energy per run on the receipt (RAPL package energy per arm)
[gcc16] GCC 16 changes (16.1 released 2026-04-30, 16.2 2026-08-07): hierarchical C++ diagnostics, SARIF 2.2-track output with logical-location nesting, experimental HTML and directed graphs, the legacy JSON format removed; and vectorisation of uncounted loops with VLA alignment peeling. publisher · read in our library knowledge/fetched/cmp_lang_gccgnuorggcc16changeshtml.html_ · pin hbcd975864eabdfd76246e98bbae24b0a336364ee47d9df51bd2e4e7635a79805 · accessed 2026-09-04 · vendor-docGrounds: Diagnostic object model rendered by three emitters
[rustc-annotate] rust-lang/rust PR 150032, merged 2025-12-17 for 1.94.0 (released 2026-03-05): annotate-snippets becomes the only stable human renderer, adopted after its output was matched to the old emitter over the test corpus; cargo has not migrated (rust-lang/cargo 15944). publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull150032.html_ · pin h4a7837c2f91f472ec7cf99ec5b884e101ec9bfd9608aca0aeeb50dafe0d39196 · accessed 2026-09-04 · source-readGrounds: Renderer snapshot corpus over the refusal census
[gcc-sarif-schema] gcc-patches, June 2024: the GCC testsuite validates every generated SARIF file against the SARIF schema and SKIPS the validation when the validator tool is absent; the mechanism is 2024, so it is a bar, not a 2026 frontier. publisher · read in our library knowledge/fetched/cmp_lang_mailarchivecomgccpatchesgccgnuorgmsg3440.html_ · pin hc57ce7eea2cd91b3c8aea688fe502f42f1a5f7a45cdf98ea80623619d045ef20 · accessed 2026-09-04 · source-readGrounds: Machine-readable diagnostics validate against a pinned schema
[sarif-tc] OASIS SARIF TC page: the only published document is SARIF 2.1.0, OASIS Standard 27 March 2020; 2.2 exists as a draft tree in the sarif-spec repository with no dated status, so it is UNDATED and watched, not cited as a standard. publisher · read in our library knowledge/fetched/cmp_lang_oasisopenorgcommitteestchomephpwgabbrevs.html_ · pin hb369429ef9849975be668e0779e49c379cf665de49b268e5b71a5874249839e0 · accessed 2026-09-04 · published-standardGrounds: Machine-readable diagnostics validate against a pinned schema
[optimuzz] Kwon, Jang, Lee, Heo. Optimization-Directed Compiler Fuzzing for Continuous Translation Validation. PLDI 2025 (presented 2025-06-20, DOI 10.1145/3729275): fuzzing directed by which optimisation changed, with a refinement oracle per pass, found 55 new LLVM miscompilations. publisher · read in our library knowledge/fetched/cmp_lang_pldi25sigplanorgdetailspldi2025papers26o.html_ · pin h40a5292a960aa2b727f3a2a3addc0a1b68961427b95eebbd10221785dbd09c6a · accessed 2026-09-04 · published-paperGrounds: Optimisation-directed fuzzing with a per-pass refinement oracle
[issuemut] Liu, Qin, Legunsen, d Amorim. Learning Compiler Fuzzing Mutators from Historical Bugs, MSR 2026 (13-14 April 2026; arXiv 2510.07834): 587 mutators mined from 1,760 GCC and LLVM bug reports found 65 new bugs, 60 confirmed or fixed. publisher · read in our library knowledge/fetched/cmp_lang_2026msrconforgprofilemarcelodamorim.html_ · pin h3733c660d8662bbac1787508665b7ce8ab55d2695aad96b9f6ee25fb5554fae9 · accessed 2026-09-04 · published-paperGrounds: Mutators mined from the compiler own bug history
[wasmtime-adv] Bytecode Alliance security advisories: Wasmtime and Cranelift commit to continuous formal verification of lowering rules against the ISA model in CI after a verified-rule staleness class of defect. publisher · read in our library knowledge/fetched/cmp_lang_bytecodeallianceorgarticleswasmtimesecur.html_ · pin h83dd7f55214355b7a6f6310cce6c5815553168bd5a9a1587420659aeb3d92148 · accessed 2026-09-04 · vendor-docGrounds: Lowering-rule verification kept fresh against the model
[compcert318] AbsInt release notes 2026-03-20: CompCert 3.18 (after 3.17 in February 2026), the verified C compiler as certified shipping practice. publisher · read in our library knowledge/fetched/cmp_lang_absintcomreleases260320htm.html_ · pin hca002ae0a79eebf393ee65de6f113fa0afecaa810a9e786f659317248c047734 · accessed 2026-09-04 · vendor-docGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[brack] Brack: a verified Scheme compiler via CakeML, mechanised in HOL4. CPP 2026 (co-located with POPL 2026). publisher · read in our library knowledge/fetched/cmp_lang_popl26sigplanorgdetailscpp2026papers15br.html_ · pin h78dcf96c3a11b1dc342ae9cb4c3541aaa11157e6a52a9ea7361de975788a5dd2 · accessed 2026-09-04 · published-paperGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[rinard10x] arXiv 2605.08927 (2026-05): full verification costs about ten times credible compilation when a coding agent writes the compiler and its certificates; the certificate-plus-independent-checker shape is the cheaper rung. publisher · read in our library knowledge/fetched/cmp_lang_arxivorgabs260508927.html_ · pin h618fc69c3a61c75d6b9d0cf234132c63dc10f4eb49e879a4800a58faf2fcea8c · accessed 2026-09-04 · published-paperGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[peepholebench] PeepholeBench, arXiv 2607.02684 (2026-07): coding agents do not yet match humans on the correctness and profitability of missed peephole optimisations; two axes, sound and profitable, scored separately. publisher · read in our library knowledge/fetched/cmp_lang_arxivorgabs260702684.html_ · pin h3d1186b6860840b809148b5afbd47fdc51037ed0e9da713b76e6f7fc6db00b44 · accessed 2026-09-04 · published-paperGrounds: Missed-peephole two-axis harness
[crater159343] rust-lang/rust PR 159343 (2026): a Crater run over 1,026,208 crates with a thirteen-way result taxonomy that names spurious regressions and fixes by reason and re-runs only the rows that changed. publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull159343.html_ · pin h3c47c98ed24c39fa3376760273b316baec330f3ae394f2e3f0b4d88e190a6609 · accessed 2026-09-04 · source-readGrounds: Whole-ecosystem rebuild census with a named-reason spurious partition
[fedora45] Fedora 45 mass rebuild, July to August 2026, against GCC 16.2, glibc 2.44 and binutils 2.47: the distribution-scale rebuild as routine practice, ALREADY-COMMON, a bar for the census row. publisher · read in our library knowledge/fetched/cmp_lang_fedoraprojectorgwikifedora45massrebuild.html_ · pin hfa2e087f71324af484e8307ace18f4af059ab286d3ec075b59a8ee7ca4c5ce70 · accessed 2026-09-04 · vendor-docGrounds: Whole-ecosystem rebuild census with a named-reason spurious partition
[rustc-directives] rustc dev guide, test directives: a known-bug directive REQUIRES an issue number, the crashes suite goes red when a crash stops reproducing, and ignore is a distinct verdict from an expected failure. publisher · read in our library knowledge/fetched/cmp_lang_rustcdevguiderustlangorgtestsdirectivesh.html_ · pin h21f02d12f6025540bbe4f7ceb713a07f5859e51f66e7766f000eb2e00806b019 · accessed 2026-09-04 · vendor-docGrounds: Known-bug rows require an issue id and go RED on unexpected pass
[llvm231] LLVM 23.1.0 release notes (2026-08-25): lit expect-fail and unsupported vocabulary, with a new unsupported listing flag; the vocabulary is ALREADY-COMMON and a bar for the known-bug row. publisher · read in our library knowledge/fetched/cmp_lang_releasesllvmorg2310docsreleasenoteshtml.html_ · pin h760b41fdcb5b796cdcae4ee413eb81b8b9f5583e9497f0cae756df17476a8eee · accessed 2026-09-04 · vendor-docGrounds: Known-bug rows require an issue id and go RED on unexpected pass
[regalloc3] regalloc3 commit history (active June and August 2026): a backtracking register allocator developed with generated-function fuzzing, the successor line to the allocator Cranelift ships. publisher · read in our library knowledge/fetched/cmp_lang_githubcomamanieuregalloc3commitsmain.html_ · pin h5aacc0672ee88377512bc4bc3f516d0545b48b1857ae7b79ac513a9240567a56 · accessed 2026-09-04 · source-readGrounds: Backtracking register allocator fuzzed with generated functions
[egraphs2026] EGRAPHS 2026 workshop programme at PLDI 2026: the field state of equality saturation, with bounded acyclic e-graphs (the Cranelift aegraph form) and stochastic-search controls as the shipped and the studied shapes. publisher · read in our library knowledge/fetched/cmp_lang_pldi26sigplanorghomeegraphs2026.html_ · pin h22f73b4592c07f94fda2fa02006316a387913ca32bbcb81a6b455a7721a273c7 · accessed 2026-09-04 · mirrored-indexGrounds: Bounded acyclic e-graph with a stochastic-search control
[guix150] LWN on Guix 1.5.0 (2026): the full-source bootstrap gains Zig and Mono chains and ships SBOMs for the seed, the reference point for bootstrap trust. publisher · read in our library knowledge/fetched/cmp_lang_lwnnetarticles1088279.html_ · pin h2f90bbc83fc3f7122b0c3ac0e188387638e7fd418b2734431100608c5d18f2eb · accessed 2026-09-04 · mirrored-indexGrounds: Full-source bootstrap chain with an SBOM of the seed
[rust-stage0] rust-lang/rust PR 149888: rustc stage0 is a downloaded prebuilt beta (2025-05-29 line) checked by repro-check rather than a from-source chain; the honest bar a self-hosting toolchain is measured against. publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull149888.html_ · pin h7f10819a59f04eec4a53c791ee9bae6d984296ae84b8390bbe4b5bdae3a65292 · accessed 2026-09-04 · source-readGrounds: Full-source bootstrap chain with an SBOM of the seed
[debian-repro-gate26] debian-devel-announce, May 2026: unreproducible packages are blocked from migrating to testing; reproducibility as a gate, admitted on the deploy board as DL14 and cross-cited here. publisher · read in our library knowledge/fetched/cmp_deploy_listsmsg00001html.html · pin h2d116d37b0ba5f990482e715e6281c913837380e65768cadbb0b105515bc5dbf · accessed 2026-09-04 · vendor-docGrounds: Reproducibility as a migration gate (bar; deploy DL14 owns the unit)
[arxiv-csse-2026-09] arXiv API listing, the COMPLETE cs.SE population for 2026-09-01 to 2026-09-07: totalResults 55 reconciles exactly against 55 entry elements, so the population is complete by construction rather than capped by max_results. Carries the abstracts of SWE-Gate 2609.04167, HEART and ToolFace 2609.01736, GenCorrect with Nemotron-3-Nano-CC 2609.02849, Eiffel-tools LSP 2609.03086, behavior-tree vulnerability detection with a quantized local model 2609.01758, MaP-SQL 2609.00834 and the placebo-controlled fault-localization study 2609.00854. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_csSE_sept2026.xml · pin hf568bff79791e4d2f2486a1af0e884146aa590223806d48f937d4e9f77ebc113 · accessed 2026-09-06 · mirrored-indexGrounds: A weak or small model reaches strong programming performance through an external decider, never through model knowledge
[arxiv-cspl-2026-09] arXiv API listing, the COMPLETE cs.PL population for 2026-09-01 to 2026-09-07: totalResults 14 reconciles exactly against 14 entry elements. Carries the abstract of PrEx 2609.00579 (accepted at LMPL 2026), which asks whether an LLM applies operational semantics handed to it in the prompt and measures that it leans on pre-training priors instead, performing especially poorly on MODIFIED semantics and degrading further as program complexity increases. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_csPL_sept2026.xml · pin hc0f8b857cb952f9e646523a5c83ef7668d1683dcce2078f2396740cb67457b9e · accessed 2026-09-06 · mirrored-indexGrounds: An LLM does not apply programming-language semantics it is handed, so a sovereign language whose semantics no model has priors for cannot rely on in-context teaching
[arxiv-slm-2026-0809] arXiv API listing, the COMPLETE population of papers whose abstract contains the phrase small language model for 2026-08-01 to 2026-09-07: totalResults 35 reconciles exactly against 35 entry elements. MEASURED WHITE SPACE: across all 35 titles and abstracts the string code generation occurs 0 times and the string programming occurs 0 times, measured with nx_txtscan count over the pinned bytes. Scope stated honestly: this is the phrase in the abstract, so a paper describing a 3B model without using that phrase would not be captured, making this a strong signal rather than a proof of absolute absence. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_slm_augsept2026.xml · pin h16776b9e0a5ade19189e6805dc52af3c316d36cd19ee28d28d3ae307393edd5d · accessed 2026-09-06 · mirrored-indexGrounds: The current small-language-model literature does not address programming at all, so the small-model programming lane is unclaimed
[arxiv-swebench-2026-09] arXiv API listing of the newest work citing SWE-bench, sorted by last update and retrieved 2026-09-06: 120 entries of which 4 carry a first-publication date in 2026-09. Used as the currency control for the coding-agent bar, confirming the benchmark line is still the active comparison surface in the current month. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_swebench_newest.xml · pin h9a3d3ca4c20267c68d517d77826341a38c7831bbf04869559e3556216c91d010 · accessed 2026-09-06 · mirrored-indexGrounds: Functional test passing is not a completion signal for a coding agent
[prex-2609-00579] PrEx full text, LaTeXML HTML from the arXiv agnostic-format lane (not a PDF, not a summarising fetcher). Verified in full text: the two semantic shifts are KeywordSwap and KeywordObf, where models must OVERRIDE FAMILIAR SYMBOL MEANINGS to follow the provided rules, and performance is especially poor there. Failure direction is the flattering one: on Fuzzer-Generated and LLM-Translated splits false success is more common, with models frequently declaring invalid programs executable despite the supplied semantics. Built on PLSemanticsBench C-star programs extended with five semantics-aware invalid transformations, evaluated under two formalisms. publisher · read in our library knowledge/fetched/cmp_lang_prex_2609_00579_full.html · pin hfab90166c2532dc5f59e684a9e45af0d128a6d567768604766431e9a0521c409 · accessed 2026-09-06 · published-paperGrounds: An LLM does not apply programming-language semantics it is handed, and it fails hardest exactly where symbol meanings are overridden
[heart-2609-01736] HEART full text, LaTeXML HTML from the arXiv agnostic-format lane. Verified in full text and materially stronger than the abstract: the default backbone is Qwen3-8B, an 8B open model, used across Planner, Router, Verifier and the Tool Primitives themselves. On 50 real-world tasks HEART reaches 84 percent task completion against GPT-5.4 at 20 percent and Claude-4.6-Sonnet at 24 percent. It reduces API cost by up to 7.4 times relative to GPT-5.4, and HEART with the Qwen3-8B backbone matches the hybrid GPT-5.4 configuration on most metrics while costing over 12 times less than HEART with GPT-5.4 throughout. The paper states Tool Primitives integrate with arbitrary backbone LLMs without architectural modification, so the orchestration layer and the execution layer scale independently. publisher · read in our library knowledge/fetched/cmp_lang_heart_2609_01736_full.html · pin hb5d604b89baf359089d6401ea3765079616325a5716c776ecf69e920fe06befb · accessed 2026-09-06 · published-paperGrounds: An 8B open model inside a retrieval-plus-verifier harness beats frontier models on task completion at a fraction of the cost
[gencorrect-2609-02849] GenCorrect and Nemotron-3-Nano-CC full text, LaTeXML HTML from the arXiv agnostic-format lane. Verified in full text with a sharper decomposition than the abstract gives: Score@1 on IOI 2025 rises 130 to 280 after SFT, to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, exceeding the gold threshold of 438.3. Post-training therefore contributed 161 points and the test-time feedback loop contributed 177, so the loop bought more than all post-training combined. Nemotron-3-Ultra-CC reaches 304 with no code-specific RL and 502.0 after five GenCorrect rounds, i.e. 198 points from test-time compute alone. publisher · read in our library knowledge/fetched/cmp_lang_gencorrect_2609_02849_full.html · pin h683116aa2db34e4852c3a982921ee06b5a8da079154ab132c79ec4113ff6f42b · accessed 2026-09-06 · published-paperGrounds: A test-time generate-evaluate-refine loop buys more capability than post-training does, on a model with 3B active parameters
[eiffeltools-2609-03086] Eiffel-tools full text, LaTeXML HTML from the arXiv agnostic-format lane. A language server for Eiffel that uses language-specific and project-specific knowledge to direct an LLM, verifies every output with a static verifier, corrects or rejects it, and handles retries until the program passes verification. Bug-fixing evaluated on two public datasets with three models, fixing 76 to 95 percent of bugs depending on model and prompt, with an explicit trade-off reported between number of fixing attempts and success rate. publisher · read in our library knowledge/fetched/cmp_lang_eiffeltools_2609_03086_full.html · pin h0a4a99a5dd3321c5ba3b17628a545dbdd69a42f4ae8c550ee56e22bd7cf83f1b · accessed 2026-09-06 · published-paperGrounds: A language server plus a static verifier in a retry loop is what makes a weak model produce correct programs in a language it does not know
[rust-releases-2026-09] releases.rs Rust Versions page re-read 2026-10-01: Stable 1.99.0, Beta 1.100.0 due 12 November 2026 (42 days left), Nightly 1.101.0 due 24 December 2026; the 2026-09-22 read was Stable 1.98.1 with Beta 1.99.0 due 1 October 2026 publisher · read in our library knowledge/fetched/cmp_lang_rust_releases_202610.html · pin hdbdb19b37b3df2d5e958a786bfa0c8070578084ae3b1c126376cef53a065dfd6 · accessed 2026-10-01 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[gcc16-changes-2026-09] GCC 16 Release Series changes page read 2026-09-22: sections for GCC 16.1 and GCC 16.2 present, AMX-TRANSPOSE removed, diagnostic machinery cleaned up in GCC 16 publisher · read in our library knowledge/fetched/cmp_lang_gcc16_changes_2026-09.html · pin h08d0af145907d48365cae32b2b92484af35e1c7bddcfa7c84d9245de8cfbb8c8 · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[go-release-history-2026-09] Go release history read 2026-09-22: go1.27.0 released 2026-08-19, go1.27.1 released 2026-09-01 publisher · read in our library knowledge/fetched/cmp_lang_go_release_history_2026-09.html · pin h10fa2f83a0e37e1663172a96f102f59ce40f02506d89e3a6f08c5a2d1c63a0af · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[zig-download-2026-09] Zig download page read 2026-09-22: master then 0.16.0 as the latest tagged release, 0.15.2 and 0.15.1 before it publisher · read in our library knowledge/fetched/cmp_lang_zig_download_2026-09.html · pin hf735c426da51b8ef6d64d098be51cc99e51a24f54e4e97ea8acbce1cf270fec6 · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[arxiv-cspl-2026-09-22] arXiv API listing cs.PL with memory safety, compiler or ownership, sorted by submission date, 30 entries read by date on 2026-09-22, newest 2026-09-21 publisher · read in our library knowledge/fetched/cmp_lang_arxiv_pl_2026-09.xml · pin hba98b4a8ac83f5e6b0b503e483bf4359fc0c0b322d6dbce4dc5ca9f0f312d495 · accessed 2026-09-22 · mirrored-indexGrounds: Superiority scorecard: every axis measured against every rival
[arxiv-fluid-2026-09] arXiv API listing, cs.PL, effect handlers OR autotuning OR energy-aware OR scheduling, sorted by submission date, 12 of 321 results; newest entries 2026-09-18 (2609.21284, authorization quiescence, off-axis) and 2026-09-14 Exo-GPU (2609.16389: parallelism and synchronization as annotations on sequential code, the compiler verifying sequential-parallel equivalence, user-schedulable, over 80 percent of H100 peak). Fetched and read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_arxiv-fluid-2026-09.xml · pin he6901ab90eaac3db2b26d6da758fb274020b8c2a5c4fcf6d443537cc80989115 · accessed 2026-09-22 · mirrored-indexGrounds: SB-LANG-FLUID and the barscan of 2026-09-22; the frontier statement of parallelism as verified annotation on sequential code
[halide-site] Halide project site: the algorithm (no storage or order) and the schedule (order, locality, implied storage: tile, vectorize, parallel, compute_at) written apart; Ragan-Kelley, Adams, Paris, Levoy, Amarasinghe, Durand, Decoupling Algorithms from Schedules (PLDI 2013; CACM Research Highlights); Adams et al., Learning to Optimize Halide with Tree Search and Random Programs (2019). Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_halide-site.html · pin h4ca049894e845c7665004549731dd0304641482af59224f8125e1f3256588abd · accessed 2026-09-22 · vendor-docGrounds: LN71 schedule as data beside the algorithm; LD14
[opencilk-site] OpenCilk project site: parallel programming as a simple extension of serial programming; provably efficient scheduling tunes each execution to its host environment. Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_opencilk-site.html · pin h5767b9eb4b1b728d8a0c903a694bb0187691f90641c4528a455300ff704dbbd8 · accessed 2026-09-22 · vendor-docGrounds: LN70 serial elision by construction; LD13
[ocaml53-effects] OCaml 5.3 manual, chapter 24 Effect handlers: the primary motivation is concurrent programming; user-level threads and their schedulers are implemented in OCaml itself; user code stays in direct style and the handlers are contained in the concurrency library; one-shot continuations suffice and are cheaper than multi-shot. Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_ocaml53-effects.html · pin hd8a98c576ab67857efc96eb9ffd4d755a11ffc69d77a5d1113824351188325bb · accessed 2026-09-22 · vendor-docGrounds: LN72 effect handlers as the scheduling seam; LD15
[mlir-site] MLIR project site: reusable and extensible compiler infrastructure addressing software fragmentation, compilation for heterogeneous hardware, and the cost of building domain-specific compilers. Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_mlir-site.html · pin h6bc933a5ee67999d50206aae919bae765b2897170a3d8a3daac8a25518a22716 · accessed 2026-09-22 · vendor-docGrounds: LN75 doors as lowering dialects; LD16
[legion-overview] Legion programming system overview (Stanford): no implicit decisions about how applications are mapped onto hardware; mapping decisions about processors and memories are made entirely by mappers, impact only performance and are orthogonal to correctness; a default mapper can never be optimal for all applications. Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_legion-overview.html · pin h7f59a648a4752701759d46d88c475d0636eb6a2bec36729f1a7b93feafbb3391 · accessed 2026-09-22 · vendor-docGrounds: LN73 mapping orthogonal to correctness; LD14
[arxiv-onelang-2026-09] arXiv API listing, cs.PL, domain-specific language OR metaprogramming OR language-oriented OR compile-time, sorted by submission date, 12 of 655 results; newest 2026-09-21: Garlene, Guarded Recursion in Lean (2609.24345: guarded recursion implemented as an EMBEDDED language in Lean through Lean's own metaprogramming, intuitive syntax and a dedicated proof mode, where no major prover supported it natively) and rawkward (2609.24628: a Rust macro-and-match dispatch layer keeps a single backend-agnostic call site while emitting vendor-specific GPU kernel strategies; a naive CUDA to HIP port loses 5 to 10x). Fetched and read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_arxiv-onelang-2026-09.xml · pin hb68cd07f33a86719cdf60249369b4b0211568741b1959521c778a7dbc5f8067e · accessed 2026-09-22 · mirrored-indexGrounds: SB-LANG-ONELANG and the barscan of 2026-09-22; the mathematician's extension written inside the language this month
[racket-site] Racket project front page: Racket, the Language-Oriented Programming Language (the languages-as-libraries school, hash-lang). Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_racket-site.html · pin ha093a656bae0b7642176fe18dc29ced69f770514a2123c2085c7b7af78e5817b · accessed 2026-09-22 · vendor-docGrounds: LN77 syntax extension elaborated in the language; LD17
[julia-why] Bezanson, Karpinski, Shah, Edelman. Why We Created Julia (14 February 2012): power Matlab users, Lisp hackers, Pythonistas, Rubyists, Perl hackers, Mathematica users; each language perfect for some of the work and terrible for the rest, each one a trade-off; we are greedy, we want the speed of C with the dynamism of Ruby, true macros like Lisp with the mathematical notation of Matlab, in one language. Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_julia-why.html · pin hc78002dce7f99e3409307b68b3a6c1dcb2316f08522af0a7924677c3b5a6c9d0 · accessed 2026-09-22 · vendor-docGrounds: LD17 and LN78: the scattered-tools problem stated by the people who solved it for numerics
[lean-site] Lean project front page: Lean is an open-source programming language and proof assistant that enables correct, maintainable, and formally verified code (hero tagline); its news items name Palomar, a registry of Lean-verified mathematics, and an interview titled How One Programming Language Rewrote Mathematics and Why Software Is Next. Read 2026-09-22 from the mirrored bytes (a first probe of this mirror missed the tagline and this row read witnessed-only for twenty minutes; corrected from the bytes, not from memory). The metaprogramming mechanism is carried by the Garlene abstract in arxiv-onelang-2026-09. publisher · read in our library knowledge/fetched/cmp_lang_lean-site.html · pin hee25ff6f7a28270a2e4020200d31a3ab5d415d5306d569478a84bf38fe53c16c · accessed 2026-09-22 · vendor-docGrounds: LN79 proofs in the language; witnessed page, claim carried by the listing
[zig-overview] Zig language overview, section Compile-time reflection and compile-time code execution (typeInfo reflection, comptime execution of ordinary Zig in place of a macro language). Read 2026-09-22. publisher · read in our library knowledge/fetched/cmp_lang_zig-overview.html · pin h7eaafa25e119cf816147c51c2c603f91d4914b8fec838f06cfbde3a568fed304 · accessed 2026-09-22 · vendor-docGrounds: LN76 compile-time execution of the language itself
[arxiv-cspl-2026-09-26] arXiv API listing, cs.PL newest 100 sorted by submittedDate, fetched and read 2026-09-26: 100 entries from 2026-08-27 to 2026-09-24 (Forte, MQSS-Selector, Oxidize, DueList, ProofGap, schedules as solvable symbols, TileBench newest) publisher · read in our library knowledge/fetched/cmp_lang_arxiv_cspl_202609.xml · pin h901bf70150a07821e02431f547e7605ef8a6d6f18d24a160012c8b974bc571b2 · accessed 2026-09-26 · mirrored-indexGrounds: SB-LANG-DOORS and the 2026-09-26 barscan of sb-lang-frontier
[arxiv-qphot-2026-09] arXiv API listing, quantum programming language OR photonic computing OR programming language in quant-ph, newest 60, fetched and read 2026-09-26: 60 entries from 2026-02-12 to 2026-09-18 publisher · read in our library knowledge/fetched/cmp_lang_arxiv_qphot_202609.xml · pin hab40bd7a59cd1b989798258943bf70d366d7f0ee09f98fb95638dfaa2140e30d · accessed 2026-09-26 · mirrored-indexGrounds: SB-LANG-DOORS and lt-any-hardware
[arxiv-msc-2026-09] arXiv API listing, cs.MS OR cs.SC newest 60 sorted by submittedDate, fetched and read 2026-09-26: 60 entries from 2026-08-31 to 2026-09-23 publisher · read in our library knowledge/fetched/cmp_lang_arxiv_msc_202609.xml · pin hdbdbaad5ab96963cd6eb297eb73a865bc00a811e0e5b5c55e27f0c7bbb27c269 · accessed 2026-09-26 · mirrored-indexGrounds: SB-LANG-DOMAINS and lt-every-domain
[darpa-opps-rss-2026-09] DARPA R&D opportunities RSS feed, read 2026-09-26: 10 items from 2026-09-01 to 2026-09-25 (Intrinsic Market Resilience, a 100-channel non-invasive BCI, the TTO office-wide solicitation, PINPOINT, five SBIR and STTR topics) publisher · read in our library knowledge/fetched/cmp_lang_darpa_opps_rss_202609.xml · pin he32a822ce5959ab5e6e33799a9bd8dd4198d4532ca4bbc0b343e16d9f5f75223 · accessed 2026-09-26 · mirrored-indexGrounds: SB-LANG-ARENAS and lt-arenas
[darpa-opps-page-2026-09] DARPA Work With Us opportunities page, fetched 2026-09-26: a script-driven listing shell whose mirrored bytes carry the navigation and the RSS link only, named so nobody cites it for content publisher · read in our library knowledge/fetched/cmp_lang_darpa_opps_202609.html · pin hb75b4ef394304a8b8f4a9dbb8d467a2a8ac44e88b2c4f407b0932a73792894f2 · accessed 2026-09-26 · vendor-docGrounds: SB-LANG-ARENAS (the feed is the witness, this page is not)
[kaggle-docker-python-2026-09] Kaggle docker-python Dockerfile.tmpl, read 2026-09-26: the notebook image is the Colab runtime image of 2026-07-16 with Python 3.12, gcc, CUDA and no Rust, Julia or wasm runtime publisher · read in our library knowledge/fetched/cmp_lang_kaggle_dockerfile_202609.txt · pin hfeb06598dea8bd5736c18331964b6031586edbcaa7dd8c58b9d960fba3c58cae · accessed 2026-09-26 · source-readGrounds: SB-LANG-ARENAS, LN87 and the sota Kaggle door row
[julia-releases-2026-09] JuliaLang julia GitHub releases API, read 2026-09-26: v1.13.0 released 2026-09-10 (v1.13.0-rc4 2026-09-03, v1.12.7 2026-08-15) publisher · read in our library knowledge/fetched/cmp_lang_julia_releases_202609.json · pin h1f4744e489b8528c23fdb8c4e253bd9469dbc8678ffff2409c2e1732ac38e70e · accessed 2026-09-26 · vendor-docGrounds: the Julia column vintage (SB-LANG-DOMAINS)
[lean4-releases-2026-09] leanprover lean4 GitHub releases API, read 2026-09-26: v4.34.1 released 2026-09-24 (v4.35.0-rc3 the same day, rc2 2026-09-16) publisher · read in our library knowledge/fetched/cmp_lang_lean4_releases_202609.json · pin hc56da142f2f52c04c46ea7de617cc4ae2edf47fb88be89e501f3d0e9168c19b5 · accessed 2026-09-26 · vendor-docGrounds: the Lean column vintage (SB-LANG-DOMAINS)
[mojo-releases-2026-09] modular GitHub releases API, read 2026-09-26: MAX 26.6 with Mojo 1.1.0 released 2026-09-17 (MAX 26.5 with Mojo 1.0.0 on 2026-08-11) publisher · read in our library knowledge/fetched/cmp_lang_mojo_releases_202609.json · pin hbba4111fdeec9b3cce8ab1b710d97c5cd61befba63d476126e8e6334c9820273 · accessed 2026-09-26 · vendor-docGrounds: SB-LANG-DOORS (the one-language CPU-plus-GPU rival)
[r-sources-2026-09] CRAN R sources page, read 2026-09-26: the latest release is R 4.6.1 (2026-06-24, Happy Hop) publisher · read in our library knowledge/fetched/cmp_lang_r_sources_202609.html · pin h563da7badd7b3cd099f7ab9f9be7fb8f754e3db918939c3cd2c1cc9bdeae011b · accessed 2026-09-26 · vendor-docGrounds: the R column vintage (SB-LANG-DOMAINS) and LN84
[moonbit-home-2026-09] MoonBit home page (IDEA, Shenzhen), read 2026-09-26: an AI-native general-purpose language with its own compiler, runtime, IDE and build system; the 2026 MoonBit September Hackathon is open this month; no version number on the page publisher · read in our library knowledge/fetched/cmp_lang_moonbit_home_202609.html · pin h3292c2457e909fd641c890e9b02d5868508eb349d140cfae81d4901fac6bc49d · accessed 2026-09-26 · vendor-docGrounds: SB-LANG-ARENAS (the Asian rival witnessed this month)
[eu-cra-2026-09] European Commission Cyber Resilience Act policy page, read 2026-09-26: in force since 10 December 2024, reporting obligations for actively exploited vulnerabilities from 11 September 2026, the main obligations from 11 December 2027, practical guidance published 27 July 2026 publisher · read in our library knowledge/fetched/cmp_lang_eu_cra_202609.html · pin h8f419e9e777168d8487bc31fd6aa5e17a3c899d4ad04d6aedcae3a973f8cca06 · accessed 2026-09-26 · published-standardGrounds: SB-LANG-ARENAS and LN89
[tractor-bench-2609-25121] TRACTOR Benchmark for Evaluating C to Rust Translators, arXiv 2609.25121 (2026-09-20): the DARPA Translating All C to Rust program benchmark for automated memory-safe translation publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_25121.html · pin hd2054d50b38005d19293f1582631074a032047e4435e6100a470407666557b93 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-ARENAS and LN88
[sympy-charlwood-2609-25616] Parallel Integration over Simple Radical Extensions in Mixed Towers: Charlwood Integrals, arXiv 2609.25616 (2026-09-22): a SymPy parallel Risch-Norman implementation returns 49 of Charlwood 50 integrals verified by differentiation publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_25616.html · pin hd323bd36cdfd381be45568f78b92e4705ace825d1c839cb28f91f9e1c999c254 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOMAINS, LN82 and the sota symbolic algebra row
[floatlib-2609-19352] FloatLib: Verified Floating-Point Arithmetic in Lean, arXiv 2609.19352 (2026-09-16): arbitrary-precision IEEE binary and decimal, posits, P3109 and user formats behind certified software backends publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_19352.html · pin h7bfa317c54e1c653f3016462165b1e51cee83d28b030e057590a5ddff427c45a · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOMAINS, LN83 and the sota exact arithmetic row
[djinnlang-2609-23954] Djinnlang: Higher-Level Programming by Unambiguous Specification with an LLM in the Compiler, arXiv 2609.23954 (2026-09-21) publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_23954.html · pin h0e20c6e72e494cd591a62ab78abb52e9e8d46be030ab1d9ffbbc8629a28282a1 · accessed 2026-09-26 · published-paperGrounds: the 2026-09-26 barscan of sb-lang-frontier
[lispbm-2609-23009] A Linked List of Cases in Language Design (LispBM on microcontrollers), arXiv 2609.23009 (2026-09-19): real users wrote programs larger than the heap and the language learned to evaluate them partitioned publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_23009.html · pin ha8e6ad110490ff9f10002c312e42e96e0499c2d707b1e7dc092e67c80ddccebe · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS, LN91 and the sota sensor door row
[granthi-2608-20443] Granthi: Higher-Order Quantum Programming via Unitary Wiring, arXiv 2608.20443 (2026-08-20) publisher · read in our library knowledge/fetched/cmp_lang_abs_2608_20443.html · pin h36327a34bfca632963b2bbd28b411444c4478fc3f2929dfa68c3774819e40722 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS and LN92
[cvqc-verif-2607-17714] Formal Verification of Continuous-Variable Quantum Programs, arXiv 2607.17714 (2026-07-20): a formal semantics and a Hoare logic for the photonic (continuous-variable) model publisher · read in our library knowledge/fetched/cmp_lang_abs_2607_17714.html · pin h2660ff9a92157b5cfa2a383e7c0ba47a38435497ac8f30eacc996bb44c7e9ccb · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS, LN93 and the sota quantum and photonic door row
[quantum-backline-2609-09270] Python in the front, party in the Backline: compiling quantum workloads across CPUs, GPUs, and FPGAs, arXiv 2609.09270 (2026-09-08) publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_09270.html · pin ha99d4caa556ca83973f8e4c2272c41cafcd6d1d0a03a8e6691f38a896bd7aca8 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS and LN92
[corten-2609-04372] Corten: Foundational Verification of Rust Programs, arXiv 2609.04372 (2026-09-03): the first mechanised semantics of surface Rust with an attached program logic in Rocq publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_04372.html · pin h4eb657bf4c4571f8a84377befc8c8e661af2073c62df8cf549c38341b8c7615c · accessed 2026-09-26 · published-paperGrounds: the 2026-09-26 barscan of sb-lang-frontier
[schedules-symbols-2609-29219] Schedules Are Solvable Symbols: Tuning-Free Compilation of Tile Programs on Dataflow Architectures, arXiv 2609.29219 (2026-09-24) publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_29219.html · pin heb7e9b1bc03ac4083dbd7f6050e38687159f8a6eee2b70d59e057f14b6ce98b4 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS, LN95 and the sota GPU door row
[forte-2609-30254] Forte: A sensitivity type system for imperative Rust, arXiv 2609.30254 (2026-09-24): the newest cs.PL entry on the read date publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_30254.html · pin h5abeb4662b1bafcaa57d47f5e50655f5178d03f4f20da5d477faad6f5da045a0 · accessed 2026-09-26 · published-paperGrounds: the 2026-09-26 barscan of sb-lang-frontier
[j-verb-rank-2609-16064] Expressing NumPy Broadcasting via Verb Rank in J, arXiv 2609.16064 (2026-09-13): array notation subsuming broadcasting publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_16064.html · pin h5b8ed87693789d2b81dfd290314cb734fa79ba73a6a4619f31bdf9ef74777e15 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOMAINS and the sota notation extension row
[gpu-bitwise-2609-11356] Taming Bitwise Behavior in GPU Kernels with Tensor Core: Black-Box Reconstruction, Compiler Enforcement, and Static Verification, arXiv 2609.11356 (2026-09-10) publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_11356.html · pin hb25aa653f21c8d7616b10cba0fe2dc0d2d88782c05101dc0e2eecfce441b42f2 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS, LN95 and the sota GPU door row
[awe-fp4-exact-2609-24519] AWE: Adaptive Weight Encoding for Exact Integer Matrix Products with Fewer GEMMs on FP4 Tensor Cores, arXiv 2609.24519 (2026-09-21): exact integer emulation of high-precision products, the integer-determinism doctrine from the hardware side publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_24519.html · pin h5ca2f776c9c0671e11897a4de220ce5441506894c9fb2de34ea6d9f5d9457348 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOMAINS and LD1
[quantum-dynamic-ir-2609-01037] A Dynamic Intermediate Representation for Hybrid Quantum-Classical Programs, arXiv 2609.01037 (2026-09-01): gates as first-class values publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_01037.html · pin h245681d5d74e468b1371a50b202a473c7b38e6cb6823182092e72ebc6d50ca03 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOORS, LN92 and the sota quantum and photonic door row
[garlene-2609-24345] Garlene: Guarded Recursion in Lean, arXiv 2609.24345 (2026-09-21): a recursion principle added to a proof assistant from inside its own metaprogramming publisher · read in our library knowledge/fetched/cmp_lang_abs_2609_24345.html · pin hee7339a9482031b26bcddcfbcd16f3bab25f79580c5e954898ae085c849ec821 · accessed 2026-09-26 · published-paperGrounds: SB-LANG-DOMAINS, LN83 and the sota proof kernel row
[mathematica-revisions-2026-09] Wolfram Mathematica quick revision history through version 14.3 (vendor page, read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_mathematica_revisions_202609.html · pin h4255283ad41dfc0614e6c3360dac9df9b8944018ae9e299da5aa00452ca17f86 · accessed 2026-09-26 · vendor-docGrounds: SB-LANG-DOMAINS and the sota Mathematica column
[cangjie-gitcode-2026-09] Cangjie compiler source repository on GitCode, release 1.3.0-alpha (read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_cangjie_gitcode_202609.html · pin h206937be3cdfc4e05393385b59dc0a78fdb483bded7733774ac09979f4396373 · accessed 2026-09-26 · source-readGrounds: SB-LANG-ARENAS the Asian toolchains
[cangjie-home-2026-09] Cangjie programming language home page, English edition (read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_cangjie_home_202609.html · pin h962aba5e3fe26c6d11a6095579eecee40aae0da4f245de2b1921ee3ed8310090 · accessed 2026-09-26 · vendor-docGrounds: SB-LANG-ARENAS the Asian toolchains
[moonbit-core-readme-2026-09] MoonBit core library README, moonbitlang/core main branch (read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_moonbit_core_readme_202609.md · pin h1f419dd277eda00d9a3ba49d68ce7d171a694d8e5cc6d35f142659281fc59b81 · accessed 2026-09-26 · source-readGrounds: SB-LANG-ARENAS the Asian toolchains
[kaggle-api-readme-2026-09] Kaggle public API client README, Kaggle/kaggle-api main branch (read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_kaggle_api_readme_202609.md · pin h5edaa4aded86315be3095dd9675a2ed6fe99d0f68a1fb55c4b3564c45e780107 · accessed 2026-09-26 · source-readGrounds: SB-LANG-ARENAS and LN85 the Kaggle door
[charlwood-full-2609-25616] Full text of arXiv 2609.25616 (HTML v1): Section 3 Problems 1-10, the Charlwood integrals the math known-answer suite carries as unreachable rows (read 2026-09-26) publisher · read in our library knowledge/fetched/cmp_lang_charlwood_2609_25616_full.html · pin h44c6e07fa5da005051e53988912d7b6071cfde7c8b9c673c0b58ac3d3d30a6d0 · accessed 2026-09-26 · published-paperGrounds: LN82 the math known-answer suite
[llvm-testing-guide] LLVM Project. LLVM Testing Infrastructure Guide: unit tests, regression tests under llvm/test with RUN lines, lit and FileCheck. llvm.org docs, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_llvm_testing_guide.html · pin h48da26b9770567c80fa66049f3e27b18ad44a1a108ef123eead275cf889934a3 · accessed 2026-09-28 · vendor-docGrounds: LN98 and LN99: the regression corpus and the golden-dump harness
[llvm-testsuite-guide] LLVM Project. test-suite Guide: SingleSource, MultiSource, MicroBenchmarks and External programs with reference outputs, timeit, compile-time metrics and LNT tracking. llvm.org docs, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_llvm_testsuite_guide.html · pin h0ce385bb7750e9225dd5221ce94e96f851ccdf4d5c29d8e533458205d8f6d2a1 · accessed 2026-09-28 · vendor-docGrounds: LN102 and LN105: whole programs timed and tracked, the real-world corpus
[fujitsu-cts-readme] Fujitsu Limited. Fujitsu Compiler Test Suite README: C, C++ and Fortran test programs with reference outputs, Apache-2.0 with LLVM exceptions since the 2025-09 release, integration into the LLVM test-suite planned. GitHub, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_fujitsu_cts_readme.md · pin h3eca1caf427a4b52d3f2a8711c33a65bfcef51ab6f44f72a22ba92e78dc84bea · accessed 2026-09-28 · source-readGrounds: LN101: the conformance corpus by language feature
[cpplinks-compilers] MattPD. C++ links: compilers, the curated index naming Alive, Souper, STOKE, the Testing LLVM notes and the compiler-testing tooling the field uses. GitHub, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_cpplinks_compilers.md · pin h4755b4d784c51fbfde0b40dff33fc4b2502bcd046fb2f9112f4abc6b8c9f0b97 · accessed 2026-09-28 · mirrored-indexGrounds: LN100, LN103 and LN106: the generator, translation validation and reduction classes
[kotlin-k2-story] JetBrains. The story behind K2 mode and how it works: the K2 compiler's frontend and backend split and the test infrastructure around an annotated program corpus. JetBrains blog, April 2025, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_kotlin_k2_story.html · pin h00a0d96e58cb66377199bd309f42fea716ac7f8f40629fa61ee3da56f055d8ef · accessed 2026-09-28 · vendor-docGrounds: LN98: directives and golden files reused across targets
[arxiv-compiler-testing-2026-08] arXiv API listing, all fields for the phrase compiler testing, sorted by submission date, 40 entries, newest 2026-08-21 (ModBench), fetched 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_compiler_testing_2026-09.xml · pin h1010ceea216c29d2d73be2ee206f4188fb8c698dda26a3de0acde1632ddbbe4c · accessed 2026-09-28 · mirrored-indexGrounds: SB-TESTING and T-FRONT-TESTING: the dated bar and the frontier
[rule-of-three] Wikipedia. Rule of three (statistics): with zero events in n trials the 95 percent upper bound on the rate is 3/n, and the numerators 3.51, 4.61 and 5.3 give 97, 99 and 99.5 percent. Read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_lang_rule_of_three.html · pin h8d3e5ed506ca010bac9ea80d4dad1ff02d23a0bf6a4c55a7979b103d298d6895 · accessed 2026-09-28 · source-readGrounds: LN100: the derived seed target, numerator x the counted source population
[arxiv-compiler-testing-2026-10] arXiv API listing, cs.SE or cs.PL whose abstract carries compiler testing, compiler fuzzing, compiler bugs, miscompilation, compiler fuzzer or translation validation, newest 40 of 106 by submittedDate, fetched and read 2026-10-03: newest entries 2609.34089 (28 Sep), 2609.38201 (22 Sep, an agent-runtime homonym) and 2609.19583 (17 Sep), no October entry publisher · read in our library knowledge/fetched/cmp_lang_arxiv_compiler_testing_tight_202610.xml · pin h4de921f982b2b921bf968f8f67dde7d06623c635aff981c4174030f5ee3deb0b · accessed 2026-10-03 · mirrored-indexGrounds: SB-TESTING and T-FRONT-TESTING
[arxiv-msc-2026-10] arXiv API listing, cs.MS OR cs.SC newest 60 sorted by submittedDate, fetched and read 2026-10-03: two entries published in October so far (2610.01922 and 2610.01338, both 1 Oct) and 2609.38492 of 29 Sep after the September read publisher · read in our library knowledge/fetched/cmp_lang_arxiv_msc_202610.xml · pin hc472a07cd8762b7da47d566725ad3654e5d83ca9a310718127727dbeb482aa63 · accessed 2026-10-03 · mirrored-indexGrounds: SB-LANG-DOMAINS
[cisa-kev-2026-10] CISA Known Exploited Vulnerabilities catalog, JSON feed, catalogVersion 2026.10.02 released 2026-10-02, 1733 entries each carrying a cwes array, 249 added in 2026, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_cisa_kev_202610.json · pin hd2c8c6cb23291b46ff2b086197641a6b1fa35e6b746bba714cc280a1778f9e48 · accessed 2026-10-03 · datasetGrounds: SB-HAZARDS and the defect-class rows
[cwe-top25-2025] MITRE, 2025 CWE Top 25 Most Dangerous Software Weaknesses, the ranked list with each entry's count of CVEs in KEV and its rank last year, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_cwe_top25_2025.html · pin h5549e8bdd7b93dfe01f16dd7d646ca79056332564501debccab0026d073c1c87 · accessed 2026-10-03 · published-standardGrounds: SB-HAZARDS and the defect-class rows
[gcp-incident-2025-06-12] Google Cloud incident report, multiple products, 12 June 2025: a Service Control change with no error handling and no feature flag met blank policy fields, the null pointer crash-looped the binaries in every region, and restarts without randomized exponential backoff overloaded the datastore; vendor post-mortem, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_gcp_incident_20250612.html · pin hda1b55660636e0dbf5c29c85685e16b27fc91ef4c21550e8ebd0b883a3cdda36 · accessed 2026-10-03 · vendor-docGrounds: LN114 and LN119
[cloudflare-outage-2025-11-18] Cloudflare, outage on 18 November 2025: a Bot Management feature file exceeded the preallocated 200-feature limit and the FL2 Rust code called unwrap on the error value and panicked; vendor post-mortem, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_cloudflare_outage_20251118.html · pin h76253f4de08f48ae11dc36985503f51a256d238f0609014af5f499499fe1aeb5 · accessed 2026-10-03 · vendor-docGrounds: LN110 and LN114
[cloudflare-outage-2025-12-05] Cloudflare, outage on 5 December 2025: Lua code indexed a field of a nil value on a skipped rule, an error the vendor says languages with strong type systems prevent and that did not occur in its Rust replacement; vendor post-mortem, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_cloudflare_outage_20251205.html · pin h66ca853ebb2800da12f5678e5bf97a2b5f28fb2012794f70c9aa892daf7504fe · accessed 2026-10-03 · vendor-docGrounds: SB-HAZARDS and T-BIC-HAZARDS
[aws-event-2025-10-19] Amazon Web Services, summary of the DynamoDB service disruption in US-EAST-1, October 2025: a latent race condition in DNS management, where a check made at the start of applying a plan was stale by the time a delayed enactor wrote an older plan over a newer one; vendor post-event summary, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_aws_event_20251019.html · pin hc020c9910f772053cdf1f3f46652c42932ac26843230d961b217b50ddc3bda29 · accessed 2026-10-03 · vendor-docGrounds: LN116
[rust-ref-not-unsafe] The Rust Reference, Behavior not considered unsafe: deadlocks, leaks of memory and other resources, exiting without calling destructors and exposing randomized base addresses are listed, and integer overflow may panic or wrap by build; the rival's own reference, read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_rust_not_unsafe.html · pin hc16a200124f3be30208a26d29e4ae8859e55c6796754b97f4738411e740c0e31 · accessed 2026-10-03 · vendor-docGrounds: T-FRONT-HAZARDS, LN110 and LN112
[kernel-bpf-verifier] Linux kernel documentation, eBPF verifier: a first step that disallows loops and detects unreachable instructions, a second that simulates every instruction on every path and refuses a read of an uninitialized register; read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_kernel_bpf_verifier.html · pin h2e9f93f013dfbafacc979a2b6d284cf74276eb3f57b16d78d5f6c029e8873b30 · accessed 2026-10-03 · vendor-docGrounds: LN111 and T-BIC-HAZARDS
[faa-ad-787-248d] Federal Aviation Administration, Airworthiness Directive for all Boeing 787 airplanes, Federal Register document 2015-10066, effective 1 May 2015: a software counter internal to the generator control units overflows after 248 days of continuous power; read 2026-10-03 publisher · read in our library knowledge/fetched/cmp_lang_faa_ad_787_248days.html · pin h392601270fcf4ff41dd4ea3b29f3c5027b35a4269d10f5717f15184411b480c9 · accessed 2026-10-03 · published-standardGrounds: LN115
[arxiv-cspl-2026-10] arXiv API listing, cs.PL newest 60 sorted by submittedDate, fetched and read 2026-10-03: entries from 2026-09-19 to 2026-10-01, three carrying October identifiers publisher · read in our library knowledge/fetched/cmp_lang_arxiv_cspl_202610.xml · pin hafd4e4ded0318dacb56bd594cb5d3fea50029016b07d58e0d248fd7227720a05 · accessed 2026-10-03 · mirrored-indexGrounds: SB-HAZARDS, LN111 and LN115

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/lang.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls