Nishi Family › Compare › NishiLang and Compiler Toolchain

Nishi Compare · capabilities, evidence and delivery

NishiLang and Compiler Toolchain

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi vs Rust and Zig and Go and Elm

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. NishiLang is a real self-hosted systems language: sovereign compiler (exceed: the whole chain bits-up), generics, sum types with exhaustiveness, two native backends, wasm, arity and type checks, caret and did-you-mean diagnostics, DWARF .debug_line, bounds-checked typed arrays, a gate-proven equality-saturation engine, and a compiler self-healing loop no peer carries in-repo; the no-float integer-determinism doctrine is proven at LLM scale (exceed). Not yet a peer of Rust, Zig, Go or Elm on what the public bug dumps say matters: raw-pointer provenance, ownership and use-after-free, checked arithmetic, option enforcement, data-race typing, closures, qualified imports, free multi-line expressions, working f64, the backend consuming its register allocation, eqsat consumed by a backend, an LSP, a formatter, incremental builds, a stepping debugger.

Where we need to go. OPERATOR STANDING ORDER 2026-09-22: NishiLang is to be SUPERIOR to Rust, gcc and every other language, decided per axis by the scorecard's own measurement against the rival version named this month, never by a claim; the word superior is not written on any page until every rival axis reads WIN. The road there is the safety rungs the language can enforce (CWE-787 125 416 190 476 362 classes), a backend that uses the registers it already allocates, eqsat rewriting real IR behind the equivalence net, and the tooling ring every peer ships -- each bite-proven and promoted only after nx_cc_equiv_gate 10/10 plus self-host stays GREEN.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: arity checks, match exhaustiveness, diagnostics and .debug_line each landed in one leg (2026-08-05 to 08-07); estimates are relative to those.

Where we are: 23 open rungs. Language core and self-healing loop real; safety enforcement and tooling ring behind. Counts measured at emit below this line.

Cost to the cheapest safety wins: 3.5 u. LN1 checked overflow (first rung already shipped for constant shifts), LN2 option enforcement, LN3 pointer provenance -- the top of the CISA roadmap.

Cost to the memory-safety core: 6 u. LN4 ownership moves, LN5 use-after-free, LN6 Send-Sync typing -- the Rust axis, staged last in this tier because each needs the type system rungs below it.

Cost to a faster backend: 3.5 u. LN7 the x86 emitter consuming its allocation (witness-backed diagnosis), LN8 eqsat rewriting IR through the pass behind the equivalence net.

Cost to the tooling ring and language ergonomics: 9.5 u. LN9 formatter (cheapest, the tokenizer already yields the stream), LN10 incremental build cache (the key is solved), LN11 LSP, LN12 stepping debugger, LN13 closures, LN14 qualified imports, LN15 free multi-line expressions, LN16 working f64.

Cost to the research-admitted ring (2026-08-19 four-lane sweep): 16 u. LR1 enforced error model, LR2 structured concurrency, LR3 supply-chain measurement, LR4 capability security, LR5 written spec, LR6 OS-browser inheritance attestation, LR7 sound bounds-check elision -- the complaint classes the sweep says cannot be retrofitted later.

Research bar. Rust 1.97 is measured on borrow checker, rust-analyzer, rustfmt, incremental compilation. Theirs: the safety and tooling bar. Ours: LN3-LN6 LN9-LN11 measured on this page.

Research bar. Zig 0.15 is measured on runtime safety modes, zig fmt, ReleaseSafe. Theirs: the checked-arithmetic bar. Ours: LN1.

Research bar. CISA memory-safe roadmaps is measured on the public case for memory safety by class. Theirs: the priority order for the safety rungs. Ours: LN3 LN4 LN5 [oncd2024].

Research bar. Rust adoption-tax record is measured on 55 percent of Rust users wait over 10 s per incremental rebuild and complexity is the community's leading worry about its own future. Theirs: the anti-bar: admired-class safety must not cost the adoption taxes. Ours: the safety rungs stay annotation-light (arena and region model) and toolchain.plan B-rungs keep builds sub-second [rustperf2025] [rustsurvey2025].

Research bar. The Midori error model is measured on typed recoverable errors in signatures plus fail-fast abandonment, with ergonomic propagation. Theirs: the errors bar; Go's 2025 capitulation proves the retrofit window closes. Ours: LR1 ships must-use Result and one-character propagation while the corpus is still ours to migrate [midori-errors] [go-errsyntax].

Research bar. Structured concurrency (Trio nurseries, JEP 505, Swift task trees) is measured on spawning only inside a scope that joins its children so cancellation and errors compose. Theirs: the 2026 concurrency floor. Ours: LR2 adds the scoped form over the colorless pool -- the async-split trap was never taken [njs-nursery] [nystrom-colors].

Research bar. The 2025 registry worms is measured on self-replicating npm compromises of 500+ packages via install-time execution and blind version trust. Theirs: why the no-registry content-addressed bet must be MEASURED as an exceed. Ours: LR3 ships the package lane with zero install-time execution and content-addressed identity [tob-supply2025].

Research bar. Capability security (Austral, Pony, the ocap lineage) is measured on authority is a value handed to main, never ambient; a dependency signature IS its permission manifest. Theirs: the supply-chain root fix no mainstream language ships. Ours: LR4 extends the estate's live ocap surface into the type system [austral-caps].

Research bar. Ferrocene qualification is measured on Rust reached safety-critical qualification only by retrofitting a written spec. Theirs: the certification floor NishiOS device lanes will demand. Ours: LR5 writes the spec and conformance suite while the language is small enough to specify [ferrocene].

Research bar. Chromium Rule of 2 is measured on untrustworthy input, an unsafe language and high privilege may never combine. Theirs: the browser inheritance bar: incumbents sandbox around their language. Ours: LR6 attests Nishi Browser parses at privilege under the enforced ring [rule-of-2].

Research bar. IDE-first compiler architecture is measured on the front-end is a lazy query database serving IDE, CLI and agents; retrofitting one is isomorphic to a rewrite. Theirs: the tooling-ring architecture bar. Ours: LN11 serves LSP from the compiler's own front-end and diagnostics, never a second parser [matklad-ide].

Latest recorded release

2026-09-22 · LN67

2026-09-22 the operator's standing order landed as data: goal row rewritten, sotabar sb-lang-rivals (Rust 1.98.1, GCC 16.2, Go 1.27.1, Zig 0.16.0, read from mirrored pages), target lt-superior (WIN on every rival axis by the scorecard, alone on the sovereign axes), rungs LN67 scorecard and LN68 rival bars, and the first ten design rows: the choices already made to keep the human side from erring, each with the error class it prevents, its source kind, its evidence and its measured effect or UNMEASURED

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

70 of 97 capability source symbols found|5 of them authored stronger-claims|27 open|coverage 721/1000|adoption 50 full / 20 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 57 vs present 57 · named + unnamed + withheld = 8 vs open 8 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 77130 bytes · gates map: PRIMARY · stamped 18d 15h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_lang.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence lang itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790056433 domain=lang target_version=2.0 rungs=85 done=43 open=42 finish=4 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
F	FINISH	Canonical formatter (LN9) srcfmt_emit	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Incremental build cache (LN10) inc_cache_lookup	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Written language specification plus conformance suite (LR5) spec_conformance_run	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	One receipt arm per mode (LN22) h2_build_nx_mode	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
#1	2.0	Capturing closures (LN13) parse_closure_capture	400	v=4 m=2 c=20
#2	later	Every parser refusal carries a location, a caret and a fix (LN46) nx_pd_line	2000	v=20 m=1 c=10
#3	later	Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity (LN47) lc_closure_scope	1000	v=30 m=1 c=30
#4	later	A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect (LN48) lc_expect_fail	1000	v=20 m=1 c=20
#5	later	Compiler diagnostics are GRADED against a known-bad fixture set, not asserted (LN49) cc_diag_grade	1000	v=30 m=1 c=30
#6	later	One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream (LN50) nx_diag_object	1000	v=30 m=1 c=30
#7	later	Verifier-in-the-loop compiler door (LN61) vl_retry_until_green	1000	v=20 m=2 c=40
#8	later	Superiority scorecard: every axis measured against every rival (LN67) ls_scorecard	1000	v=15 m=2 c=30
#9	later	Bounds-check elision with a cost model (LN43) bck_elide_cost_model	666	v=10 m=2 c=30
#10	later	The build lane declares its compile mode (LN44) cb_mode_policy	666	v=10 m=2 c=30
#11	later	Errors as values, enforced with propagation (LR1) res_propagate_op	600	v=6 m=2 c=20
#12	later	A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore (LN52) lc_known_bug_id	400	v=4 m=1 c=10
#13	later	Rival release bars as data on a beat (LN68) ls_rival_bars	400	v=4 m=1 c=10
#14	later	Integer SIMD reduction vectorization (LN19) opt_vec_reduce	225	v=6 m=3 c=80
#15	later	memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling (LN35) wasm_memory64	200	v=2 m=2 c=20
#16	later	A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal (LN51) lc_diag_snapshot	150	v=3 m=1 c=20
#17	later	Loop splitting for non-implied bounds (IRCE) (LN20) bck_irce_split	120	v=3 m=2 c=50
#18	later	Energy per run on the receipt (LN23) h2_energy_arm	100	v=1 m=2 c=20
#19	later	A missed-peephole candidate is scored sound and profitable on two printed axes (LN55) opt_peephole_bench	100	v=1 m=1 c=10
#20	later	The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator (LN57) x86_regalloc_backtrack	100	v=3 m=1 c=30
#21	later	Language-level capability security (LR4) cap_root_main	66	v=1 m=2 c=30
#22	later	Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses (LN58) eqsat_bounded_acyclic	50	v=1 m=1 c=20
#23	later	Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane (LN59) sp_mutator_from_bug	50	v=1 m=1 c=20
#24	later	After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason (LN53) lc_rebuild_partition	33	v=1 m=1 c=30
#25	later	Three optimisation passes emit certificates an independent checker accepts over the whole census (LN54) opt_pass_certificate	33	v=1 m=1 c=30
#26	later	An f64 ordered compare of a single-use loaded operand is correct (LN37) x86ctx_cmp_f64_operands	0	v=0 m=1 c=10
#27	later	A NaN operand compares unordered: every ordered predicate false, only != true (LN38) x86ctx_emit_f64_nan_guard	0	v=0 m=1 c=10
#28	later	Decimal exponent float literals (LN36) lex_number_exponent	0	v=0 m=1 c=10
#29	later	Float and f64 constant-expressions (LN39) const_eval_f64	0	v=0 m=1 c=10
#30	later	A large-fraction literal is refused, never looped on (LN40) fp64_from_parts_bounded	0	v=0 m=1 c=10
#31	later	nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes (LN42) axc_apply_section	0	v=0 m=1 c=20
#32	later	An unclosed brace is reported where it was opened (LN45) nxcx_brace_balance	0	v=0 m=1 c=10
#33	later	The wat lane refuses what it cannot lower (LN13a) wat_die_unlowerable	0	v=0 m=2 c=10
#34	later	Board-level journal anchor for lang (LN) -	0	v=0 m=1 c=100
#35	later	Cross-domain journal anchor: autodev entries recorded on this board (autodev) -	0	v=0 m=1 c=100
#36	later	Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent (LN56) cc_diag_schema	0	v=0 m=1 c=10
#37	later	Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning (LN60) count_global_tokens	0	v=0 m=1 c=30
#38	later	The estate as a retrieval-time tool catalogue with a router (LN62) tp_route_primitive	0	v=0 m=1 c=40
#39	later	Test-time generate-evaluate-refine for organ authoring (LN63) gc_refine_round	0	v=0 m=1 c=40
#40	later	A compact model-facing view of the IR (LN64) mir_emit_compact	0	v=0 m=1 c=40
#41	later	Population-complete research currency, mechanically verified (LN65) ac_census_complete	0	v=0 m=2 c=40
#42	later	The dot builtins lower on every door (LN66) wat_lower_q8blkdot	0	v=0 m=2 c=30

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Self-hosted sovereign compiler (LB0)	func main(argc	gen2 == gen3 fixpoint, equiv gate 10/10 -- LANDED	Organ	0 u
Arity and param-type checks (LB1) after LB0	prepass_count_params	Compiler-enforced, bite-proven live -- LANDED 2026-08-05	Organ	0 u
Match exhaustiveness (LB2) after LB0	parse_stmt_match	Missing and unreachable arms refused by name -- LANDED	Organ	0 u
Rich diagnostics (LB3) after LB0	nx_diag_caret	Caret, did-you-mean, multi-error recovery -- LANDED	Organ	0 u
Bounds-checked typed arrays (LB4) after LB0	NX_BOUNDS_CHECK_LIVE	Live checks, cost measured 2.23x -- LANDED	Organ	0 u
DWARF .debug_line (LB5) after LB0	lm_stmt_stamp	Statement-granularity line table, readelf-validated -- LANDED	Organ	0 u
Equality-saturation engine (LB6)	nx_eqsat_union	Seven gates, 93 teeth, all GREEN -- LANDED 2026-08-14	Organ	0 u
Checked integer arithmetic (LN1) after LB0	chk_add_overflow	i64 add and mul trap or refuse on overflow under a declared mode (the shift-count rung already ships); gate proves an overflowing add traps and an in-range add is byte-identical to today	Organ	1 u
Option enforcement (LN2) after LB1	opt_enforce_unwrap	A pointer or Option value must be unwrapped through a checked path before deref in checked mode; gate proves the sentinel-zero deref class (the recurring P2 meta-class) is refused at compile time on a fixture and the stdlib still builds	Organ	1 u
Raw-pointer provenance (LN3) after LB4	bck_ptr_provenance	A raw *u8 deref carries its allocation extent where the compiler can see one (arena allocations, sys_mmap results) and is checked like typed arrays; gate proves the 2026-07-08 READ-TO-NUL over-read fixture traps	Organ	1.5 u
Ownership moves (LN4) after LN3	own_check_move	Move semantics for owned buffers: use after move is a compile error; gate proves a fixture double-use is refused and the existing corpus builds unchanged under the default mode	Organ	2.5 u
Use-after-free prevention (LN5) after LN4	own_check_uaf	With LN4, a freed or released owner cannot be read; gate proves a planted UAF fixture is refused and the arena no-free doctrine is now enforced not assumed	Organ	1.5 u
Data-race typing (LN6) after LN4	sync_send_check	Send-Sync-class marker on values crossing the thread pool; gate proves a non-Send value handed to nx_pool_submit is refused	Organ	2 u
Backend consumes its register allocation (LN7) after LB0	x86_use_regalloc	The x86 emitter keeps allocated values in their registers instead of spilling to stack homes on entry (the witness: loop counter in r12, accumulator in r13, still reloaded); done-rule: nx_probe_bchk_asm shows no home reload and the checked loop bench improves, equiv net 10/10 plus self-host GREEN -- LANDED 2026-08-23 (x86_use_regalloc, nx_x86_64_ctx.nx): the homed loop counter is compared IN PLACE (movq+cmpq scratch copy removed), main() 64->60 instrs, nx_bounds_perf checked hot loop -16.5% (8278us->6912us median); SOUND cross-block forwarding (cut-the-load-block availability, self-host-proven after a merge-unsound draft was caught and rewritten); nx_x86_regalloc_use_gate 5/5 GREEN, 3/5 RED vs banked pre-LN7; equiv 10/10+selfhost GREEN; LN1/LN2/LN3/LN8 still GREEN; promoted a21068ae both roots	Organ	2 u
Eqsat consumed by the backend (LN8) after LB6	opt_eqsat_pass	The pass rewrites real IR through the e-graph under the proven rule table, queued behind the equivalence net; done-rule: x xor x folds where const_fold cannot, controls hold, byte-identical on the 13,201-source population except the rewritten sites	Organ	1.5 u
Canonical formatter (LN9) after LB0	srcfmt_emit	Idempotent formatter over the tokenizer stream; gate proves fmt(fmt(x)) == fmt(x) and the formatted corpus builds to byte-identical binaries -- SHIPPED 2026-08-23: nx_srcfmt live and registered, nx_srcfmt_gate 13/13 GREEN, style measured from the corpus, the token-stream oracle guarantees non-mutation	Organ	1 u
Incremental build cache (LN10) after LB0	inc_cache_lookup	Per-module cache keyed by the closure sha the build door already computes (the B2 cache keys whole targets); gate proves a one-file edit rebuilds only its dependents and the output equals a full build	Organ	2 u
Language server (LN11) after LB3,LN9	lsp_serve	Honest greenfield (nx_lsp.nx does not exist): diagnostics, goto-def and hover over the genealogist's code graph; gate proves initialize plus a diagnostics round-trip against a recorded client transcript	Organ	3 u
Stepping debugger (LN12) after LB5	dbg_step_over	The doctor lane's DT1: break and step on our own binaries over the line table we emit (one contract, two pages)	Organ	3 u
Capturing closures (LN13) after LB0	parse_closure_capture	Closures capturing by value into a compiler-emitted environment struct; gate proves a captured counter increments across calls and a capture of a moved value is refused once LN4 lands	Organ	2 u
Qualified imports (LN14) after LB0	imp_qualified_name	Namespace-qualified names so two organs may export the same identifier; gate proves a shadow collision from the 2026-06-23 census compiles unambiguously with qualification	Organ	1.5 u
Free multi-line expressions (LN15) after LB0	tok_line_continuation	A continuation line opening with a binary operator joins the previous statement instead of becoming a dead statement (the det2x2 bug class); gate proves the fixture that caused the runtime-wide sweep now computes and a lone operator line is a diagnosed error	Organ	1 u
Working f64 arithmetic (LN16) after LB0	x86ctx_emit_f64	Correct SSE2 emission for f64 add sub mul div; done-rule: nx_probe_float run-exit=0 (1.5 plus 1.5 equals 3.0), deliberately low priority under the no-float doctrine	Organ	1 u
Errors as values, enforced with propagation (LR1) after LB1	res_propagate_op	A dropped Result refuses (must-use) and a one-character propagation form rethrows with context; abandonment stays fail-fast (the Midori split); backfill census before enforcement; witness refuse and accept both directions	Organ	2 u
Structured concurrency: scoped spawn (LR2) after LB0	sc_scope_spawn	Spawn exists only inside a scope that joins its children; child error propagates to the scope; cancellation is scoped; the orphan-task shape is unrepresentable; pool witnesses stay green	Organ	2 u
Package lane: content-addressed, zero install-time execution (LR3)	pkg_cas_resolve	An external module resolves by content hash with no version negotiation and no code execution at install; a planted typosquat cannot resolve; the supply-chain bet becomes a measured exceed	Organ	2 u
Language-level capability security (LR4) after LN4	cap_root_main	main receives root capabilities and syscall surfaces require a capability value; a dependency demanding new authority fails to compile; extends the live ocap ops surface into the type system	Organ	3 u
Written language specification plus conformance suite (LR5)	spec_conformance_run	The spec documents syntax, types, memory and refusal semantics; the conformance runner drives the shipped compiler over the suite and a planted deviation goes RED (the Ferrocene lesson taken early)	Organ	3 u
NishiOS and Nishi Browser inheritance attestation (LR6) after LN1,LN4	oa_state_name	The attestation organ rebuilds the nishios kernel and browser closures under the enforcing compiler (ring on, crash guard on) and writes a receipt both compare pages cite; the Rule-of-2 unsafe-language leg is discharged by measurement	Organ	2 u
Sound bounds-check elision (LR7) after LN7	bck_elide_dominated	A dominated in-range re-check is elided ONLY under the blessed dominance oracle (an unsound elision is a silent memory-safety hole, the elision proof gate is the tooth); h2h checked lane approaches the unchecked band	Organ	2 u
Induction-guarded bounds-check elision (LN17) after LN7,LR7	bck_elide_induction	The loop guard proves the single check inside its loop under a fixed rule set (non-escaping local counter, constant resets, guarded constant steps, no store on a guard-to-access path, guard bound not above the array length); nx_bck_iv_gate GREEN with both refusal directions bite-proven, nx_cc_equiv_gate 10/10 plus self-host GREEN, then promote_toolchain and the receipt re-measured by the promoted compiler	Organ	2 u
Checked arithmetic at add-plus-jo cost (LN18) after LN1,LN7	x86ctx_ovf_fuse	The x86 emitter renders the LN1 overflow shape as add then jo (sub then jo, imul then jo) with no spills; nx_chkarith_gate stays GREEN, the equivalence net passes, and the receipt shows the daily mode within 1.3x of the default build on the accumulate loop	Organ	3 u
Integer SIMD reduction vectorization (LN19) after LN8,LN17	opt_vec_reduce	Integer reductions with a provable trip count are emitted as packed adds under the equivalence net; the receipt shows the f1 mode within 1.2x of gcc -O2 on the accumulate loop	Organ	8 u
Loop splitting for non-implied bounds (IRCE) (LN20) after LN17	bck_irce_split	A guard wider than the array yields pre, main and post loops with the main loop check-free; the F2-shaped fixture still traps at exactly the first out-of-range index	Organ	5 u
Compiler modes as declared data (LN21) after LN1,LN7	nxcx_expand_mode	Every mode is a knowledge/lang_modes.conf row expanded into declared flags; an undeclared mode refuses by name; --mode=f1 is byte-identical to its bundle (gate tooth)	Organ	1 u
One receipt arm per mode (LN22) after LN21	h2_build_nx_mode	The h2h receipt carries nishilang-<mode> arms built through --mode and the page renders them beside the rival compilers; nx_lang_h2h_gate GREEN	Organ	1 u
Energy per run on the receipt (LN23) after LN22	h2_energy_arm	Each arm carries package energy from RAPL or a named UNMEASURABLE; the first VALID column comes from a host that exposes powercap	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M1 · Cheap safety wins and honest diagnostics	LN1,LN2,LN3,LN24,LN25,LN27,LN29,LN30,LN31,LN32	8.5 u
M2 · Faster backend and the tooling ring	LN7,LN8,LN9,LN10,LN11,LN12	13 u
M3 · Memory-safety core and ergonomics	LN4,LN5,LN6,LN13,LN14,LN15,LN16	26.5 u
M4 · Industry-complaint ring and OS-browser inheritance (research-admitted 2026-08-19)	LR1,LR2,LR3,LR4,LR5,LR6,LR7	42.5 u
M5 · Real competition: modes, elision, vectorization and energy on one receipt (admitted 2026-09-01 from September 2026 research)	LN17,LN18,LN19,LN20,LN21,LN22,LN23	22 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
A lexer desync is attributed to the file and line that broke (LN24) after LB3	diag_desync_origin	A raw control byte or an unterminated string literal in the LAST user file surfaces as a flood of unknown-name errors inside the auto-appended crash handler with THAT file's line numbers (MEASURED 2026-09-02: a raw NUL inside nx_inline_vec_measure_gate.nx read as twenty errors at nx_crash.nx lines 36 to 99, and the author looked in the wrong file; the control organ nx_probe_hexesc proved high-byte hex escapes ARE honoured, so only the attribution is wrong). The lexer refuses a control byte other than tab, LF and CR by file and line, and reports an unterminated literal at ITS opening line before any later file is expanded. Gate proves a planted NUL and a planted unterminated string are each named at their own file and line, and the neg-control proves a clean corpus builds byte-identical	Organ	1 u
Compiler capacity limits are diagnostics, not asserts (LN25) after LB3	diag_capacity_named	nx_cc dies with nx_assert_lt idx=4096 cap=4096 tag=ir_block_new when one function exceeds the IR block pool (MEASURED 2026-09-02: a 253-name entity if-chain in nx_html_entities.nx), naming the pool and not the function, so the author cannot tell which function to split. Every capacity cap (blocks per function, same-callee call sites, module count) is reported as an error naming the function, the cap, the measured count and the remedy. Gate proves an over-cap function is named with its count and that a function one below the cap compiles unchanged	Organ	1 u
Line tables ride every API build so a fault address resolves on the deployed binary (LN26)	hc_build_debug_armed	SOURCE-LANDED 2026-09-02 (nx_hostctl cmd_buildrun), supervisor rebuild queued. MEASURED: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and the instruction to rebuild with -g; by the time anyone looked the source had moved, and nx_addr2line refused the deployed binary (no .debug_line section). The toolchain already had the whole chain (nx_cc -g emits .file/.loc, nxasm builds DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line decodes it, nx_dwline_e2e_gate runs the -g ELF) and NO build path passed the flag. Now every /api/build passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, rule 17: disarm by writing 0, no rebuild). Done when a freshly built organ answers nx_addr2line with file:line for an address inside its text on the PROMOTED binary AND the byte-identity censuses (nx_gatestale, nx_artifactdrift) treat the appended table as the like-for-like they already recognise in nx_rebuild_drain	Organ	0.5 u
Every diagnostic teaches: one voice with location, caret, why and fix (LN27) after LB3	diag_voice_gate	The parser's teaching errors already print the offending line with a caret (nx_diag_caret), then a why-the-build-stopped line and a fix line; the LN24 desync messages landed 2026-09-02 without them and the operator named the output as not helping a programmer grow to mastery. Estate-wide: every error site in the tokenizer, parser, IR, assembler and the build door carries what, where (file:line plus caret), why and how to fix, in that one voice, and the capacity asserts (LN25) join it. A gate walks every diagnostic emission site in the toolchain sources and refuses a site that prints a location without a why line and a fix line, with the positive control of the existing teaching sites passing and a planted bare location failing. Owner: the lang lane	Organ	2 u
SIMD lane intrinsics for the quantized decode (LN28) after LB3	x86ctx_emit_q4kunpack32s	LANDED 2026-09-02 on the laptop toolchain (blessed through nx_bless_compiler NEUTRAL: nx_cc_equiv_gate 10 of 10 plus self-host GREEN, nx_game_gate no-regression 127 to 127, nx_tc_canary 8 of 8). __q4k_unpack32s(qs, out, sc_lo or sc_hi shl 16) turns one Q4_K sub-block pair (32 packed nibble bytes) into 64 i16 lanes already multiplied by their 6-bit scale, emitted as 14 AVX2 instructions in VEX .byte form (vpmovzxbw, vpsrlw, vpand, vpmullw, vpbroadcastw, vmovups; the mask is built from vpcmpeqd and vpsrlw so no memory constant), five toolchain sites (nx_types OP_Q4KUNPACK32S 151, nx_ir, nx_parse, nx_x86_64_ctx, nx_x86_regalloc). Proof: nx_q4k_simd2_gate 9 of 9 -- lane-exact on 5000 random blocks against the scalar spread, dot-exact on 200 real-shaped rows against BOTH incumbent rulers, two neg-controls. The family this opens: a Q6_K unpack (the 28 fallback rows at 7B), a Q8_0 widen, and a lane-wise i16 multiply-add with the scale folded, each landing the same way. Done-rule met: the emitted unpack replaces about 1.4 scalar ops per weight and the fused dot runs 3.94x faster than the scalar-unpack SIMD dot on the 14-super-block row	Organ	1 u
A field name must belong to the struct it is read from (LN29) after LB3	parse_field_of_struct	A field access p.f where f is not declared by the struct type of p is refused by name; today it resolves against every struct's field table and reads another struct's offset (measured 2026-09-02: f.name_bytes on a *Function compiled and printed junk). Gate proves the fixture is refused with the struct and its real fields named, and the corpus builds unchanged	Organ	1 u
An else with no if is refused, never run (LN30) after LB3	parse_stmt_dangling_else	An else that begins a statement is refused by name with where, why and fix (measured 2026-09-02: a stray else absorbing a missing brace compiled with exit 0 and ran its block unconditionally inside nx_autofix_intake_gate, counting every row twice); gate proves the silent-class and loud-class fixtures are refused by name while else-if chains and plain if/else still compile; the corpus builds unchanged	Organ	1 u
A keyword at module level is named, not blamed on a brace (LN31) after LN30	parse_module_stray_keyword	A statement keyword at module level (var, let, else, return, if, while) is refused with its own cause -- var: module state is `static name: type`; let: const or static; the rest: a function above closed early -- with where, why and fix, and parsing continues to the end gate; gate proves a module-level var is refused by name and its static twin compiles	Organ	0.5 u
A bare block statement is a scope (LN32) after LN31	parse_stmt_block	`{ ... }` at statement start parses as a scoped block: names declared inside die at its closing brace, sibling blocks may reuse a name, a leaked name is refused by name; the block fixture runs and returns its computed value; the three estate sources written with C-style inline blocks build	Organ	0.5 u
wasm threads from the sovereign compiler: shared memory, atomics, wait and notify (LN33) after LN6	wat_mem_shared	OPERATOR 2026-09-03 (max performance from current browsers, a launch that needs no install): the served world pages already carry COOP same-origin and COEP require-corp so SharedArrayBuffer is unlocked, and nothing spends it because the sovereign wasm backend emits no threads -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify, SharedArrayBuffer named only in a router comment. Done when nx_wasm and nx_wasm_scalararm emit a shared memory with a declared maximum plus the 0xFE-prefixed atomic loads, stores, rmw ops, wait and notify for i32 and i64, nx_compile_wat lowers them, NishiLang surfaces them as an atomic intrinsic family beside the LN6 send marker (a struct shared across Workers must be send-marked or the compiler refuses by name), and a gate instantiates the module in the sovereign VM twin AND in a browser over the CDP wire with two Workers incrementing one shared counter without loss, the neg-control being the non-atomic add that loses increments; the GE27 digest tooth then reads the threaded frame bit-identical to the single-thread frame. Consumers: gameengine GE30 (tiles across every core) and performance PF13 (the tick off the render thread)	Organ	2 u
The same atomic names lower to hardware on the native lanes: LOCK-prefixed x86-64, rv64 AMO, futex wait and notify (LN34) after LN33	rv_home_t6	OPERATOR 2026-09-03 (scale from a sensor to a supercomputer, the browser is never the ceiling): the __atomic_* builtins (nx_atom.nx) lower to OP_ATOMIC_*: LOCK on x86-64 (pre-existing), 0xFE on wasm (LN33), lr/sc + AMO on rv64 (LN34 source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim and on the NAS); done when nx_x86_64 lowers nx_atomic_add32 and family to LOCK xadd, cmpxchg, xchg and mfence, the rv64 backend to amoadd, amoswap, lr and sc and fence, nx_atomic_wait32 and notify to the futex syscall on Linux and to the NishiOS kernel wait queue, all behind the SAME call names the wasm lane intercepts (one source, three lowerings), proven by a two-worker nx_pool counter that loses ZERO increments natively where the reference bodies lose some (the same lost-update neg-control the browser proof used), plus the LN6 send-marker refusing an unmarked struct shared through them	Organ	2 u
memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling (LN35) after LN33	wasm_memory64	the emitter wraps every address to i32 and the WAT compiler encodes 32-bit limits, so a world larger than 65536 pages cannot exist on the browser door; done when a module declaring `static nx_wasm_memory64_req: i64 = 1` emits `(memory i64 MIN MAX)` (the memory64 limits flag), every load, store and atomic drops the i32 wrap, the mmap helper grows in i64, the WAT compiler and the VM twin carry the flag, a module past the wasm32 ceiling instantiates in a memory64 browser over the CDP wire, and a module WITHOUT the declaration still emits wasm32 byte-identical to today	Organ	2 u
An f64 ordered compare of a single-use loaded operand is correct (LN37) after -	x86ctx_cmp_f64_operands	LANDED 2026-09-03. The f64 compare emitter cleared the G1 op0-in-rax fact BEFORE the operand loads, so a G4-elided operand was re-read from a slot nothing wrote and tripped .G4_elided_slot_load_bug on any f64 ordered compare of a loaded value; the clear now happens after the ordering-key transform. Toolchain 6cf44630 canary GREEN.	Organ	1 u
A NaN operand compares unordered: every ordered predicate false, only != true (LN38) after LN37	x86ctx_emit_f64_nan_guard	LANDED 2026-09-03. The ordering-key transform made a NaN a total order so n != n read false and a sign-set NaN sorted below every number; an integer-only guard (exponent 2047 and mantissa nonzero, no ucomisd needed) now forces the IEEE-correct flags. Proven by nx_f64_gate 27 of 27 GREEN and bite RED against the pre-fix compiler.	Organ	1 u
Decimal exponent float literals (LN36) after -	lex_number_exponent	OPEN. lex_number in nx_tokenizer accepts a fraction and f32 or f64 suffixes but has no exponent form, so 1e-9 does not lex; today such constants are spelled in full decimals. Cheapest of the three literal gaps.	Organ	1 u
Float and f64 constant-expressions (LN39) after -	const_eval_f64	OPEN. const_eval_primary in nx_parse accepts only integer literals, so const X: f64 = 0.5 is refused; today f64 module constants are written as zero-argument functions.	Organ	1 u
A large-fraction literal is refused, never looped on (LN40) after -	fp64_from_parts_bounded	OPEN. A 20-digit fraction overflows the exact-rational packer in nx_quant (10 to the 20 exceeds i64) and the compiler loops instead of refusing; today tiny values like 1e-20 are built by multiplying representable literals.	Organ	1 u
nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes (LN42)	axc_apply_section	THE BUS STOP UNDER LN36, SPECIFIED FROM THE SOURCE RATHER THAN LEFT AS A COMPLAINT. Today a writable static may only be ZERO-initialised: x86ctx_emit_module_globals emits a loud invalid line for any non-zero one because .rodata is read-only on the GNU lane and nxasm maps .data (and .bss) to section id 2 = IGNORE (axc_apply_section, nxasm_x86.nx:1051-1064). But nxasm's section 1 tail is ALREADY WRITABLE -- that is exactly how .lcomm works, and its own comment says 'zero-filled MUTABLE slot ... our single-image model appends to the data tail' -- so .data is a both-lanes-correct emission that was simply never taught. Done when: axc_apply_section maps a bare .data and .section .data to section 1; x86ctx_emit_module_globals emits .data + .Lg<id>: + a .byte list for writable non-zero globals in a SECOND pass after the rodata stream (so output stays byte-identical when no such global exists, which nx_cc_equiv_gate proves); a gate compiles a fixture with static x: i64 = 42, WRITES to x and reads it back, with a neg-control that the pre-fix compiler refuses it; and the toolchain promote is canaried. Unblocks the three organs already carrying the workaround by name (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib) and every future dual-target module	Organ	2 u
The wasm memory is declared on the BUILD LANE so one source builds at a sensor's memory and at a supercomputer's (LN41) after LN33	watd_atoi	LANDED 2026-09-03. LN33 let a module declare its memory with statics; a DUAL-TARGET module cannot, because the native lane refuses a non-zero static initializer by name, and it should not have to -- a target's limit is a declared door on a ladder, never a constant in the source. nx_compile_wat --shared <pages_req> <pages_max> moves it to the build lane, --nothreads emits the unshared twin at the same declared size, and absent the flag the WAT is byte-identical. nx_wasm_threads_gate 37/37 GREEN on the NAS; driver promoted 6c6f5f4d, gate promoted 1895335d.	Organ	1 u
Bounds-check elision with a cost model (LN43) after LR7	bck_elide_cost_model	The modulo arm of nx_bck_elide_gate is GATED rather than merely published, elision is DECLINED on shapes that measure slower, and the div-free win is preserved at or above 1.9x across three sequential rounds on the live compiler	Organ	3 u
An unclosed brace is reported where it was opened (LN45) after -	nxcx_brace_balance	LANDED 2026-09-03. A single missing closing brace made every later declaration parse INSIDE that block, so the module-level const on line 2 of nx_crash.nx -- the crash handler the builder APPENDS to every program -- read as an assignment and the whole cascade was attributed to a file the author never wrote. The driver now walks the TOKEN stream after lexing (so a brace inside a string or comment cannot confuse it), remembers the OUTERMOST still-open brace, and refuses with a caret on it, the depth, and the reason the errors would otherwise surface elsewhere. A stray closer gets its own message.	Organ	1 u
The build lane declares its compile mode (LN44) after LR7	cb_mode_policy	The mode organs are compiled with is DATA read by the build lane, not an omission; a target moved to the f1 bundle is proven output-identical by nx_behaveprobe before the move, and the published h2h receipt shows the default arm closing on the f1 arm	Organ	3 u
Every parser refusal carries a location, a caret and a fix (LN46) after -	nx_pd_line	LANDED 2026-09-03. parse_die and two sibling raw-write refusal sites printed a bare one-line sentence with no file, no line, no caret and no fix -- 35 call sites in all. nx_diag_organ_at had existed since the file-attribution pass, waiting for a line number that parse_die never had. Every token in the unit passes through advance_tok, so recording line and col at that ONE chokepoint gives every site a truthful location without touching a single call site; a site reached before any token was consumed keeps the bare form rather than pointing at line 0.	Organ	1 u
The wat lane refuses what it cannot lower (LN13a) after LB0	wat_die_unlowerable	LANDED 2026-09-04. The precondition under LN13, and it is worth a rung on its own because it closes a silent-miscompile class that existed with no closures anywhere. The wat backend answered an IR opcode it had no arm for with a WAT COMMENT and return 0, without storing a result local, so the module assembled, instantiated and RAN while computing zero at that instruction. Only 41 of the 141 declared opcodes have an arm in that emitter and OP_CALL_INDIRECT 144 was one of the 100 that did not, which is what every function-pointer call lowers to. Done when a function-pointer call through nx_compile_wat is refused BY NAME with its opcode number and emits no module, an ordinary direct call still compiles byte-identically, and both are bound in a gate that goes RED against the pre-fix binary.	Organ	1 u
Board-level journal anchor for lang (LN)	-	BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 5 log rows against the id LN, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.	Board	0 u
Cross-domain journal anchor: autodev entries recorded on this board (autodev)	-	DECLARED 2026-09-04 by nx_board_idref_gate. Two log rows on THIS board are addressed to the id autodev and describe work in the autodev DOMAIN, not in lang: they record nx_autofix_intake_gate going RED 3 of 5 to GREEN 5 of 5. They are also an EXACT DUPLICATE PAIR at the same epoch with identical text, which is the signature of a double-applied append rather than two findings. Declaring the anchor is additive and makes them resolvable instead of dangling; it does NOT make them correctly filed. THE OWNING LANE SHOULD RE-JOURNAL THAT FINDING ON THE AUTODEV BOARD against a real autodev rung, after which this anchor can be retired through nx_retire_path. Nothing is deleted here on purpose: history is additive and a mis-addressed record still is a record.	Board	0 u
Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity (LN47)	lc_closure_scope	DONE-RULE PRE-DECLARED 2026-09-04, before the organ exists. The census resolves each program's transitive imports the way the builder does (_hdl_build/ first, then runtime/) and stamps every ERR row PROVEN or UNPROVEN by whether EVERY file in the closure is byte-identical to the estate manifest, not merely the erroring file. Done when: the organ reproduces the hand-computed partition of 2026-09-04 (135 proven, 119 unproven, 30 excluded, summing to 284) from the same two inputs, AND a planted stale import under a byte-identical leaf moves that row from PROVEN to UNPROVEN. The second half is the anti-vacuity tooth: a scoper that never demotes a row has not been shown to fire.	Organ	3 u
A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect (LN48)	lc_expect_fail	DONE-RULE PRE-DECLARED 2026-09-04. Every mainstream toolchain declares negative tests in the fixture -- rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck -- and the estate has no equivalent, so its compile-refusal worklist contains rows where fixing them destroys the control. Done when: a declaration field exists and the census partitions expect-fail from defect MECHANICALLY, the 7 fixtures found on 2026-09-04 by their own prose are all declared, AND at least one fixture that carries no marker phrase (z.nx and the _nxiq_ family are the known cases) is caught by the declaration and would have been missed by the vocabulary scan. That last clause exists because the 7 is a FLOOR and a mechanism that only reproduces the floor has added nothing.	Organ	2 u
Compiler diagnostics are GRADED against a known-bad fixture set, not asserted (LN49) after LN46	cc_diag_grade	DONE-RULE PRE-DECLARED 2026-09-04. The shipping compiler already emits the three-part shape Elm set the bar for -- a caret line, a why-the-build-stopped clause and a fix clause -- and names the enclosing construct, but NONE of that is measured, so the quality claim on this board is an assertion. Done when: a fixture set of known-bad programs with expected span and expected suggestion is scored for span accuracy and suggestion correctness, the score is PUBLISHED on this page rather than claimed, and a deliberately regressed diagnostic (a refusal stripped of its caret) lowers the score. Carries its own negative control by construction.	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
M6 · The measurement lab: the field's instruments as oracles, our evidence, and sovereign twins any seat can run (admitted 2026-09-04 under the estate-wide measurement standing order)	LN47,LN48,LN49	8 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream (LN50)	nx_diag_object	DONE-RULE PRE-DECLARED 2026-09-04. The same object renders through all three emitters [gcc16] [rustc-annotate]; a planted nested child must appear in all three; the machine sink validates against the pinned schema (LN56).	Organ	3 u
A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal (LN51) after LN50	lc_diag_snapshot	DONE-RULE PRE-DECLARED 2026-09-04. Snapshot per refusal over the whole census, count printed [rustc-annotate]; a renderer that drops a nested child must show at least one differing snapshot; an identical renderer must show zero.	Organ	2 u
A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore (LN52) after LN48	lc_known_bug_id	DONE-RULE PRE-DECLARED 2026-09-04. Parse refusal without an id [rustc-directives] [llvm231]; fixing the planted bug must turn the row RED; rows per class printed so zero of zero cannot read green. Extends LN48.	Organ	1 u
After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason (LN53) after LN47	lc_rebuild_partition	DONE-RULE PRE-DECLARED 2026-09-04. Partition regressed, fixed, spurious-regressed, spurious-fixed, unchanged sums to the population [crater159343] [fedora45]; a planted admission refusal lands in spurious with its reason; a retry lane re-runs only changed rows.	Organ	3 u
Three optimisation passes emit certificates an independent checker accepts over the whole census (LN54)	opt_pass_certificate	DONE-RULE PRE-DECLARED 2026-09-04. Unreachable-code, dead-assignment and constant-fold certificates checked by code shared with no pass, count printed, self-host rebuild still byte-identical [rinard10x] [compcert318] [brack]; a mutant that folds one constant wrongly is refused naming pass and site.	Organ	3 u
A missed-peephole candidate is scored sound and profitable on two printed axes (LN55)	opt_peephole_bench	DONE-RULE PRE-DECLARED 2026-09-04. Sound by the equivalence probe, profitable by instruction count [peepholebench]; an unsound profitable rewrite reports REJECTED, never one of two.	Organ	1 u
Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent (LN56) after LN50	cc_diag_schema	DONE-RULE PRE-DECLARED 2026-09-04. Schema mirrored and pinned [sarif-tc] [gcc-sarif-schema]; a planted malformed diagnostic is refused by field name; removing the validator yields SKIP, never GREEN.	Organ	1 u
The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator (LN57)	x86_regalloc_backtrack	DONE-RULE PRE-DECLARED 2026-09-04. Behavioural equality over a printed count of generated functions [regalloc3]; a planted mis-assignment is caught by the fuzz lane; depends on the allocator watch x86_use_regalloc.	Organ	3 u
Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses (LN58)	eqsat_bounded_acyclic	DONE-RULE PRE-DECLARED 2026-09-04. Bound in a conf row [egraphs2026]; the stochastic control and the bounded run agree on the census subset, counts printed; a bound of zero must be refused as vacuous.	Organ	2 u
Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane (LN59)	sp_mutator_from_bug	DONE-RULE PRE-DECLARED 2026-09-04. Each mutator names the defect row it came from [issuemut]; a replayed mutator must reproduce its origin defect on the pre-fix binary and pass on the fixed one; prerequisite: defect rows carry their triggering input.	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M7 · September 2026 SOTA: correctness assurance, diagnostics and bootstrap trust, admitted from the verified compiler sweep as watches and pre-declared contracts	LN50,LN51,LN52,LN53,LN54,LN55,LN56,LN57,LN58,LN59,LN66	24 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning (LN60) after LN49	count_global_tokens	DONE-RULE PRE-DECLARED 2026-09-05 (operator, same day: numbers need evidence on why they are set or need to be dynamic, no guessing; this belongs to the NishiLang shape and theory with research and reasoning as of September 2026). MEASURED CAUSE: parse_module derived its FUNCTION pool from counted func tokens after a 256-slot pool corrupted nxc.nx twice (T#selfhost-004/006), but kept a DECLARED 4096 for the GLOBALS pool behind a comment claiming it could not be derived -- and on 2026-09-05 the nx_wgsl unit (shader front-end + both backends + the world and cast shaders) reached 4097 and the build stopped at the guard. It CAN be derived: every global is anchored to a TK_STRING, TK_STATIC, TK_FLOAT/TK_FLOAT_F32 or TK_FUNC token, so the bound is that sum plus a NAMED slack for backend-synthesised entries, wrong only in the direction of surplus (address space never faulted in). THEORY, as of Sept 2026: a bound is a claim about the input; a claim with no witness is a guess that fails in silence when the input grows past the day it was typed, and the estate has now paid for that three times in ONE file. The language shape is therefore: (a) a pool is sized by a pass over the thing it will hold; (b) where the size is genuinely unknowable in advance (a network body), the bound is NAMED for that one purpose and its exhaustion ANNOUNCES; (c) a const that sizes anything carries, in its own comment, the measurement or the spec it came from, so a reader can re-derive it. Done when: (1) count_global_tokens lands, nx_wgsl builds past 4096 and the guard stays armed (a planted under-count refuses BY NAME, bite-proven); (2) a census organ walks the toolchain closure (nx_types, nx_lex_kinds, nx_tokenizer, nx_parse, nx_ir, nx_opt, nx_x86_64_ctx, nxasm_x86, nx_compile_x86) and lists EVERY const that sizes a pool, cap, buffer or table with a derivation class -- DERIVED-FROM-INPUT, EVIDENCED (the adjacent comment names a measurement or a published spec) or BARE -- published on this page, BARE ratcheting to zero; (3) the research is fetched, pinned and cited (candidate sources to fetch, NOT yet citations: Zig std allocator and ArrayList growth, Rust Vec amortised growth and the RFC on capacity overflow, LLVM SmallVector, the Go slice growth policy, plus the estate's own three pool incidents as the measured cost) so the principle is a written part of the NishiLang shape rather than a memory	Organ	3 u
Verifier-in-the-loop compiler door (LN61) after LB0	vl_retry_until_green	The September-2026 shape for making a weak or local model produce correct programs in a language it does not know. Eiffel-tools [eiffeltools-2609-03086] pairs a language server with a STATIC VERIFIER and retries until the program verifies, fixing 76 to 95 percent of bugs across two datasets and three models, and the verifier is what carries the correctness rather than the model. We already own the harder half: nx_cc refuses, and the gates decide. What is missing is a MACHINE-READABLE refusal plus a retry protocol a weak engine can drive without a frontier model in the loop, so that compiler refusals become a control signal instead of prose a human reads. This is the highest-leverage rung on the board because it converts all future organ authoring from frontier-token work into local work, and organ authoring is currently the frontier seat's entire residual against the 96-new-token local ceiling. Done-rule: a local engine reaches a declared first-try-green rate on a held-out organ set, measured by the incumbent nx_build_firsttry_lib and not by a new ruler.	Organ	4 u
The estate as a retrieval-time tool catalogue with a router (LN62) after LN61	tp_route_primitive	HEART [heart-2609-01736] is this estate's own thesis measured by someone else, and its full text is stronger than its abstract: the backbone is Qwen3-8B, an 8B OPEN model, driving Planner, Router, Verifier and the Tool Primitives themselves, reaching 84 percent task completion on 50 real-world tasks against GPT-5.4 at 20 and Claude-4.6-Sonnet at 24, at up to 7.4 times lower API cost, and HEART on Qwen3-8B matches the GPT-5.4 hybrid on most metrics at over 12 times less cost. Two design points transfer directly. Tools are wrapped so SCHEMA RESOLUTION HAPPENS INSIDE THE TOOL rather than by enumerating raw API schemas in the caller's context, and the orchestration layer and the execution layer scale INDEPENDENTLY. We already hold the catalogue of roughly 940 registered tools, the retriever in nx_capsearch, the Verifier in the gate fleet and a Planner in nx_goalmap and nx_compare_rank. The thin part is the ROUTER and the natural-language tool wrapper. Done-rule: a local engine completes a declared task set through the router at a measured cost ratio against the frontier path, with the ratio published beside the completion rate so a cost win that loses quality is visible as a regression.	Organ	4 u
Test-time generate-evaluate-refine for organ authoring (LN63) after LN61	gc_refine_round	GenCorrect [gencorrect-2609-02849] decomposes cleanly in full text and the decomposition is the argument: Nemotron-3-Nano-CC at 3B ACTIVE parameters goes 130 to 280 after SFT to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, past the 438.3 gold threshold. Post-training bought 161 points and the test-time loop bought 177, and the Ultra model gained 198 points from the loop with no code-specific RL at all. The transfer is exact: propose N organ candidates, run the GATE on each, refine from the gate's own output, repeat within a declared round budget. The estate already owns every piece except the loop itself, in nx_gate_bite and nx_sov_build_run with build-only. This is the direct answer to the 96-new-token local ceiling, because the loop trades ROUNDS for parameters rather than needing a bigger model. Done-rule: a declared organ set is authored to gate-green by a local engine within a named round budget, with the round count and the budget both published, and a neg-control organ that must NOT reach green.	Organ	4 u
A compact model-facing view of the IR (LN64) after LN61	mir_emit_compact	PrEx [prex-2609-00579] settles what NOT to build here: models lean on pre-training priors rather than applying semantics handed to them, and are WORST under KeywordSwap and KeywordObf, the shifts where familiar symbol meanings must be overridden. NishiLang is exactly that case and worse, because it resembles C without matching it, so a model's priors are ACTIVELY WRONG rather than merely absent, and the failure direction is the flattering one since models frequently declare invalid programs executable. So no spec-stuffing and no fine-tuning rung will be opened on this board. What DOES transfer is representation: measured on a quantized local model, a compact control-flow representation fit the context where the AST overflowed, and REPRESENTATION CHOICE BEAT MODEL SIZE. We already have an IR. Emit a compact model-facing VIEW of it so the local ceiling rises without anyone claiming the model understands the language. Done-rule: the view is emitted from the existing IR with no second IR created, and a declared task set measures higher local first-try-green with the view than without it, the comparison run on the same engine.	Organ	4 u
Population-complete research currency, mechanically verified (LN65) after LB0	ac_census_complete	The sotabar and barscan law needs an attestation that a month's listing was actually READ, and until now that attestation was a seat's word. nx_arxiv_census composes the incumbents rather than duplicating them, taking se_fetch from nx_search_extern and em_int_after with em_collect_yms and em_maxym from nx_search_emerge, and asks the ONE question neither incumbent asks: does opensearch:totalResults reconcile against the entries actually delivered. Equal means the window is a POPULATION and an absence claim over it is sound; fewer means a SAMPLE wearing a population's clothes and absence over it is UNPROVEN. This is what converts the measured zero behind sb-slm-code-whitespace from an assertion into a verdict, and it also produces the barscan newest= field mechanically via em_maxym. The currency control for the agent bar is the SWE-bench listing [arxiv-swebench-2026-09]. Done-rule: the organ exits COMPLETE on a window whose counters reconcile, CAPPED on one where max_results truncates the population, and a bite plants a deliberately truncated window that MUST be named CAPPED rather than passing.	Organ	4 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.

best-in-class (lt-peer-systems), dated by sb-lang-frontier = 2026-09 FRESH. Be a peer of Rust, Zig and Go on the axes the public bug dumps actually blame: raw-pointer provenance, ownership and use-after-free, checked arithmetic, option enforcement, data-race typing, and a backend that consumes its own register allocation instead of discarding it. The compiler, its diagnostics, its line tables and its equality-saturation engine are already landed and proven; what is unmet is the safety and codegen band, and it is unmet on evidence rather than on design. ref arxiv-cspl-2026-09

frontier (lt-typed-security), dated by sb-lang-frontier = 2026-09 FRESH. Enforce security properties BY TYPING AND CONSTRUCTION rather than by discipline, which is where September 2026 cs.PL actually sits: type-directed secure-by-construction compilation and verified capability compartmentalisation, both proved rather than asserted. Our capability-security, provenance, ownership and use-after-free rungs are on that axis, and the exceed candidate is that a sovereign compiler can carry the property end to end from its own source rather than bolting it onto someone else's toolchain. ref arxiv-cspl-2026-09

Rung	Role	Toward	Stands on	Why
LB0	substrate	lt-peer-systems	-	The self-hosted compiler is what every other rung on this board is written in and compiled by; nothing here is reachable without it.
LB1	substrate	lt-peer-systems	LB0	Arity and parameter-type checking is the floor the safety rungs extend rather than a claim they compete on.
LB2	substrate	lt-peer-systems	LB0	Match exhaustiveness is the enforcement mechanism option handling and error propagation both build on.
LB3	substrate	lt-peer-systems	LB0	Rich diagnostics with caret and did-you-mean are the substrate every later diagnostic rung refines.
LB4	substrate	lt-peer-systems	LB0	Bounds-checked typed arrays are the checked baseline the elision rungs are measured against.
LB5	substrate	lt-peer-systems	LB0	The DWARF line table is what makes a fault address resolvable and the stepping debugger possible.
LB6	substrate	lt-peer-systems	-	The equality-saturation engine is the optimiser substrate the backend consumption rung spends.
LN1	contender	lt-peer-systems	LB0	Checked integer arithmetic is a direct peer-parity number against the rival languages.
LN2	contender	lt-peer-systems	LB1	Option enforcement is one of the named axes the public bug dumps blame, so its done-rule is a comparison.
LN3	contender	lt-typed-security	LB4	Raw-pointer provenance is enforcement by typing, which is the frontier axis this month names.
LN4	contender	lt-typed-security	LN3	Ownership moves make the unsafe shape unrepresentable rather than merely discouraged.
LN5	contender	lt-typed-security	LN4	Use-after-free prevention turns the arena no-free doctrine from an assumption into an enforced property.
LN6	contender	lt-typed-security	LN4	Data-race typing is the send and sync marker class, a typed-security claim rather than a convention.
LN7	contender	lt-peer-systems	LB0	A backend that consumes its register allocation is the codegen parity number against gcc-class output.
LN8	contender	lt-peer-systems	LB6	Eqsat consumed by the backend is where the optimiser stops being a demonstration and becomes performance.
LN9	substrate	lt-peer-systems	LB0	A canonical formatter is tooling the peer languages all have; it enables adoption rather than winning a number.
LN10	substrate	lt-peer-systems	LB0	The incremental build cache is what makes the whole loop affordable enough to iterate on.
LN11	substrate	lt-peer-systems	LB3,LN9	A language server is table stakes tooling the target consumes, not an axis it competes on.
LN12	substrate	lt-peer-systems	LB5	A stepping debugger consumes the line table and makes failures inspectable.
LN13	substrate	lt-peer-systems	LB0	Capturing closures are expressiveness the safety rungs then have to cover.
LN13a	substrate	lt-peer-systems	LB0	Refusing what the wat lane cannot lower closes a silent-miscompile class beneath every wasm claim.
LN14	substrate	lt-peer-systems	LB0	Qualified imports are the namespacing the corpus needs before it can scale.
LN15	substrate	lt-peer-systems	LB0	Free multi-line expressions are ergonomics, enabling rather than competing.
LN16	substrate	lt-peer-systems	LB0	Working f64 arithmetic is deliberately low priority under the no-float doctrine and enables the float rungs only.
LN17	contender	lt-peer-systems	LN7,LR7	Induction-guarded elision is a measured performance number against the unchecked band.
LN18	contender	lt-peer-systems	LN1,LN7	Checked arithmetic at add-plus-jo cost is the number that decides whether safety is free.
LN19	contender	lt-peer-systems	LN8,LN17	Integer SIMD reduction is an explicit ratio against gcc -O2 on the accumulate loop.
LN20	contender	lt-peer-systems	LN17	Loop splitting for non-implied bounds is a codegen capability the rivals ship and we are measured on.
LN21	substrate	lt-peer-systems	LN1,LN7	Compiler modes as declared data is the mechanism every receipt arm reads.
LN22	arm	lt-peer-systems	LN21	One receipt arm per mode triangulates the performance claims without itself being a performance number.
LN23	arm	lt-peer-systems	LN22	Energy per run is a second independent axis beside speed, which is what an arm is for.
LN24	substrate	lt-peer-systems	LB3	Attributing a lexer desync to its true file and line is diagnostic machinery the whole board rests on.
LN25	substrate	lt-peer-systems	LB3	Capacity limits as diagnostics rather than asserts is what stops a cap from reading as a crash.
LN26	substrate	lt-peer-systems	-	Line tables riding every API build is what makes a deployed fault address resolvable at all.
LN27	substrate	lt-peer-systems	LB3	One diagnostic voice with location, caret, why and fix is the standard the later renderer rungs implement.
LN28	substrate	lt-peer-systems	LB3	SIMD lane intrinsics are the primitive the quantized decode consumes.
LN29	substrate	lt-peer-systems	LB3	Refusing a field name that does not belong to its struct closes a whole class of silent misreads.
LN30	substrate	lt-peer-systems	LB3	An else with no if refused rather than run removes a control-flow trap from the language.
LN31	substrate	lt-peer-systems	LN30	Naming a stray module-level keyword stops the parser blaming an innocent brace.
LN32	substrate	lt-peer-systems	LN31	A bare block statement being a scope is a semantics fix the safety rungs depend on.
LN33	arm	lt-typed-security	LN6	wasm threads with shared memory and atomics triangulate the concurrency story on a second target.
LN34	arm	lt-typed-security	LN33	The same atomic names lowering to hardware on the native lanes is the cross-target witness for LN33.
LN35	arm	lt-peer-systems	LN33	memory64 makes the wasm32 four gigabyte wall a declared door rather than a ceiling.
LN36	substrate	lt-peer-systems	-	Decimal exponent literals are the cheapest of the literal gaps and enable the float rungs.
LN37	substrate	lt-peer-systems	-	A correct ordered f64 compare of a single-use loaded operand is codegen correctness beneath any float claim.
LN38	substrate	lt-peer-systems	LN37	NaN comparing unordered on every ordered predicate is the semantics the float rungs require.
LN39	substrate	lt-peer-systems	-	Float constant-expressions remove the zero-argument-function workaround from module constants.
LN40	substrate	lt-peer-systems	-	Refusing a large-fraction literal rather than looping on it removes a hang from the lexer.
LN41	substrate	lt-peer-systems	LN33	Declaring the wasm memory on the build lane lets one source build at a sensible size on every target.
LN42	substrate	lt-peer-systems	-	Assembling non-zero writable static initialisers is an assembler capability the language depends on.
LN43	contender	lt-peer-systems	LR7	Bounds-check elision with a cost model is the number that decides whether checks are affordable.
LN44	substrate	lt-peer-systems	LR7	The build lane declaring its compile mode is what makes any mode-dependent claim readable.
LN45	substrate	lt-peer-systems	-	Reporting an unclosed brace where it was OPENED is diagnostic quality the rivals already have.
LN46	substrate	lt-peer-systems	-	Every parser refusal carrying a location, caret and fix is the LN27 standard made universal.
LN47	substrate	lt-peer-systems	-	Scoping a refusal figure by closure identity rather than leaf identity is what makes the census honest.
LN48	substrate	lt-peer-systems	-	A must-not-compile fixture declaring itself lets a refusal census tell a real refusal from an accident.
LN49	arm	lt-peer-systems	LN46	Grading diagnostics against a known-bad fixture set is an independent referee on diagnostic quality.
LN50	substrate	lt-peer-systems	-	One diagnostic object feeding a nested renderer is the machinery the schema and swap rungs check.
LN51	arm	lt-peer-systems	LN50	Adjudicating a renderer swap by byte-diff count is a referee on a change rather than a capability claim.
LN52	substrate	lt-peer-systems	LN48	Refusing a known-bug row without an issue id extends LN48 so a count of zero cannot read green.
LN53	substrate	lt-peer-systems	LN47	Re-checking every downstream source after a toolchain change is what makes a toolchain claim trustworthy.
LN54	contender	lt-typed-security	-	Optimisation passes emitting certificates an independent checker validates is proof by construction.
LN55	arm	lt-peer-systems	-	Scoring a missed peephole sound and profitable is a referee on the optimiser, not a rival number.
LN56	substrate	lt-peer-systems	LN50	Validating every machine-readable diagnostic against a pinned schema is what stops silent format drift.
LN57	contender	lt-peer-systems	-	An allocator that backtracks on spill pressure is a direct codegen quality number.
LN58	substrate	lt-peer-systems	-	Bounding saturation acyclically with the bound as data keeps the eqsat engine terminating and readable.
LN59	arm	lt-peer-systems	-	Extracting mutators from the estate's own compiler defects is a referee that grows from real history.
LN60	substrate	lt-peer-systems	LN49	Deriving every pool, cap and buffer instead of guessing removes a defect generator from the toolchain.
LN61	arm	lt-peer-systems	LB0	The verifier-in-the-loop door triangulates whether a weak engine can author organs; it is not a language axis.
LN62	arm	lt-peer-systems	LN61	The estate as a retrieval-time tool catalogue is an authoring-cost arm rather than a language claim.
LN63	arm	lt-peer-systems	LN61	Test-time generate-evaluate-refine is an authoring-loop arm measured in rounds, not in language capability.
LN64	arm	lt-peer-systems	LN61	A compact model-facing IR view raises what a local engine can author without changing the language.
LN65	arm	lt-peer-systems	LB0	Population-complete research currency is the measurement apparatus every bar on this board is graded by.
LN	substrate	lt-peer-systems	-	The board-level journal anchor is the record-keeping every claim on this board is written against.
LR1	contender	lt-peer-systems	LB1	Errors as values with enforced propagation is a named peer-parity axis against Rust and Go.
LR2	contender	lt-typed-security	LB0	Structured concurrency making the orphan-task shape unrepresentable is enforcement by construction.
LR3	arm	lt-typed-security	-	A content-addressed package lane with zero install-time execution triangulates supply-chain safety.
LR4	contender	lt-typed-security	LN4	Language-level capability security is THE frontier axis this month names, proved rather than asserted.
LR5	substrate	lt-peer-systems	-	A written specification with a conformance suite is what any peer claim has to be measured against.
LR6	arm	lt-typed-security	LN1,LN4	The NishiOS and browser inheritance attestation is an independent witness that the language leg discharges.
LR7	contender	lt-peer-systems	LN7	Sound bounds-check elision is the number that brings the checked lane toward the unchecked band.
autodev	substrate	lt-peer-systems	-	The cross-domain journal anchor exists so log rows addressed to the autodev domain on this board have a referent; it is record-keeping substrate and never a capability claim.

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The dot builtins lower on every door (LN66) after LN33	wat_lower_q8blkdot	__i16_dot and __q8blk_i16dot (OP_I16DOT, OP_Q8BLKDOT) lower only in nx_x86_64_ctx today, so a source that composes them cannot be built for the wasm or rv64 doors; the ONE SOURCE, MANY DOORS order (2026-09-03) requires a lowering on each door: nx_compile_wat lowers both ops to i16x8 and i32x4 SIMD where the profile has v128 and to a plain loop under --nothreads or a v128-less profile, the rv64 emitter lowers to a scalar loop first (the vector extension later), and the feature program _q8blkdot_minrepro.nx must exit 0 on every door it is built for. DONE-RULE: nx_cc_equiv_gate's feature leg runs the minrepro through the wat door in the estate wasm VM (nx_wasm_vm_verify) and through nx_rv64_sim with exit 0 on both, and the widest-block and most-negative-block answers are byte-identical on all three doors; a door that lacks the lowering must REFUSE the op by name at compile time, never emit a silent zero	Organ	3 u

Rung	Role	Toward	Stands on	Why
LN66	substrate	lt-peer-systems	LN33	a peer compiler lowers one intrinsic on every target it claims; a builtin that exists on one door is a door-specific dialect wearing the language's name

frontier (lt-superior), dated by sb-lang-rivals = 2026-09 FRESH. SUPERIOR, not peer: on every axis a rival publishes (run-time speed on the h2h checksum against gcc -O2 and Rust, compile time, binary size, energy by the Energy-Languages method, the CWE classes the public bug dumps blame, diagnostics graded against a known-bad set, the tooling ring) NishiLang reads WIN on the scorecard's own measurement against the rival version named this month, and on the axes no rival has (a sovereign chain from the first byte, integer determinism, the self-healing compiler loop, eqsat behind the equivalence net) it is alone; the word superior is not written on any page until every rival axis reads WIN ref rust-releases-2026-09

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Superiority scorecard: every axis measured against every rival (LN67) after LN22	ls_scorecard	An organ composes the incumbents (nx_lang_h2h for speed with its checksum, the build lane for compile time and binary size, the Energy-Languages method for energy, the safety-class census, the graded diagnostics of LN49, the tooling-ring rows) into ONE receipt per rival per axis reading WIN LOSE TIE or UNMEASURED with the number beside each, rendered on the board and appended to a spine so the climb is a trajectory; the gate proves a planted loss cannot read WIN and an unmeasured axis cannot read TIE; PRE-DECLARED: the first receipt reads LOSE on speed, because the 2026-09-01 h2h bench measured NishiLang checked at 3.33x gcc -O2 and 1.6x Rust checked, and that number is the first bar to beat	Organ	3 u
Rival release bars as data on a beat (LN68) after LN67	ls_rival_bars	The four release pages are fetched monthly, the current versions parsed into a pinned bar row, so every WIN or LOSE names the rival version it was measured against; the gate proves a planted version change flips the bar and an unchanged page leaves it	Organ	1 u

Rung	Role	Toward	Stands on	Why
LN67	contender	lt-superior	LN22	its done-rule is a WIN row per axis per rival, the only definition of superior that is a number
LN68	substrate	lt-superior	LN67	a win against an unnamed version is a win against nobody

Ladder verdict. targets 3 (best in class 1, frontier 2, undated 0); rungs 85, placed 85 (substrate 49, arm 16, contender 20, superseded 0), unplaced 0; verdict LADDERED Bars: 6 (fresh 6, attested 0, stale 0, unattested 0), verdict FRESH against the current month 2026-09.

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Design choices

Every design choice is a claim with its evidence beside it. A row names the choice, the error class it prevents, where it came from (research, a mined shape from the estate's own bug record, a thought leader, or the operator), the rung ids and reference keys that stand behind it, its status (adopted, proposed or retracted) and the effect it measured, or UNMEASURED. A row is refused, and says so here, when its status or source kind is outside those words or when its evidence names a key that is neither a rung on this plan nor a reference in this domain's register. The same table renders on every domain that lands design rows; the shape is shared, the rows are the board's.

Id	Choice	Error class it prevents	Source	Evidence	Status	Measured effect
LD1	Integer determinism: no floats in the sovereign lane, fixed-point everywhere	the same source computing different answers on different hosts or toolchains	operator	LN17, LN19, LN23	adopted	the served 1.5B engine runs integer kernels byte-identical across the laptop and the NAS (KAT 2026-09-16); the pos row calls it the proven exceed
LD2	Bounds-checked typed arrays with a named refusal	CWE-787 and CWE-125 out-of-bounds write and read	research	LR1, LN1	adopted	an array-bounds-violation refusal shipped in the front door and the content ruler named it as a live superset on 2026-08-21
LD3	Sum types with exhaustiveness checked by the compiler	the unhandled case, the missing else branch that compiles clean	research	LR2	adopted	UNMEASURED
LD4	Refuse first and name the rule: every refusal carries the rule that fired	a silent wrong answer, or an answer about a different subject than the one asked	operator	LN46, LN50	adopted	one plane reader's single MISS was five conditions; naming them as seven exits ended a false dead-lane filing (2026-08-21)
LD5	The verdict line is LAST and judged by position, never by text	a parser that reads the data as the answer	mined-shape	LN48, LN52	adopted	an unanchored verdict regex produced 26 GREEN and 18 RED phantom verdicts in one day (2026-08-07) before positional anchoring
LD6	A number is derived from the resource it describes, never a literal renamed into a constant	a hand-counted length beside a string drifting when the string changes	operator	LN60	adopted	13,375 value-named constants existed estate-wide before the rule (2026-09-17); the G2P and formant organs still carry them, the cost of the rename era
LD7	Every organ ships with a gate that bites a planted known-bad	the vacuous test: a check the defect cannot fail	mined-shape	LN48, LN61	adopted	nine shipping gates had fired GREEN on every run of their history (2026-08-21); that census is why the bite is mandatory
LD8	One standard library for strings, numbers, argv and files, one owner each	the duplicate ruler at the language level: every organ re-implementing print, length, parse and concatenation	mined-shape	LN9	proposed	six RIFF writers and at least eight print clones measured in one tree on 2026-09-21; a seat re-implemented the same five helpers twice that day
LD9	else-if and slices in the surface syntax	logic hidden under nested else blocks and hand-rolled offset arithmetic	thought-leader	LR1	proposed	UNMEASURED
LD10	Ownership and pointer provenance typed against the estate's OWN mined bug shapes rather than adopted wholesale from Rust	use-after-free and provenance loss, CWE-416	research	LN2, LN6	proposed	the pos row lists these unmet on evidence rather than design; the mined shape census that would size them is LR1

Design ledger verdict. rows 10 = adopted 7 + proposed 3 + retracted 0 + refused 0 (status 0, source 0, evidence 0) + malformed 0 (partition sum 10); unmeasured claims 2; evidence tokens 17 (dead 0), rows with no evidence declared 0; verdict CLEAN. A refused row is rendered with its rule and stays a claim nobody may cite until its data is repaired.

Inspect a rung and its prerequisites

Declared nodes 85. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 0c490f14a69eb9e0ad5533d907e2a048f2218b0a3f32c7b11df1d8140887cf98. Target rows 3; role rows 85. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 85 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

LB0 — Self-hosted sovereign compiler
Prerequisites: None declared; this does not establish execution eligibility.
Contract: func main(argc
Acceptance: gen2 == gen3 fixpoint, equiv gate 10/10 -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB1 — Arity and param-type checks
Prerequisites: LB0 (acceptance unverified)
Contract: prepass_count_params
Acceptance: Compiler-enforced, bite-proven live -- LANDED 2026-08-05
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB2 — Match exhaustiveness
Prerequisites: LB0 (acceptance unverified)
Contract: parse_stmt_match
Acceptance: Missing and unreachable arms refused by name -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB3 — Rich diagnostics
Prerequisites: LB0 (acceptance unverified)
Contract: nx_diag_caret
Acceptance: Caret, did-you-mean, multi-error recovery -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB4 — Bounds-checked typed arrays
Prerequisites: LB0 (acceptance unverified)
Contract: NX_BOUNDS_CHECK_LIVE
Acceptance: Live checks, cost measured 2.23x -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB5 — DWARF .debug_line
Prerequisites: LB0 (acceptance unverified)
Contract: lm_stmt_stamp
Acceptance: Statement-granularity line table, readelf-validated -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LB6 — Equality-saturation engine
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_eqsat_union
Acceptance: Seven gates, 93 teeth, all GREEN -- LANDED 2026-08-14
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN1 — Checked integer arithmetic
Prerequisites: LB0 (acceptance unverified)
Contract: chk_add_overflow
Acceptance: i64 add and mul trap or refuse on overflow under a declared mode (the shift-count rung already ships); gate proves an overflowing add traps and an in-range add is byte-identical to today
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN2 — Option enforcement
Prerequisites: LB1 (acceptance unverified)
Contract: opt_enforce_unwrap
Acceptance: A pointer or Option value must be unwrapped through a checked path before deref in checked mode; gate proves the sentinel-zero deref class (the recurring P2 meta-class) is refused at compile time on a fixture and the stdlib still builds
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN3 — Raw-pointer provenance
Prerequisites: LB4 (acceptance unverified)
Contract: bck_ptr_provenance
Acceptance: A raw *u8 deref carries its allocation extent where the compiler can see one (arena allocations, sys_mmap results) and is checked like typed arrays; gate proves the 2026-07-08 READ-TO-NUL over-read fixture traps
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN4 — Ownership moves
Prerequisites: LN3 (acceptance unverified)
Contract: own_check_move
Acceptance: Move semantics for owned buffers: use after move is a compile error; gate proves a fixture double-use is refused and the existing corpus builds unchanged under the default mode
Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN5 — Use-after-free prevention
Prerequisites: LN4 (acceptance unverified)
Contract: own_check_uaf
Acceptance: With LN4, a freed or released owner cannot be read; gate proves a planted UAF fixture is refused and the arena no-free doctrine is now enforced not assumed
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN6 — Data-race typing
Prerequisites: LN4 (acceptance unverified)
Contract: sync_send_check
Acceptance: Send-Sync-class marker on values crossing the thread pool; gate proves a non-Send value handed to nx_pool_submit is refused
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN7 — Backend consumes its register allocation
Prerequisites: LB0 (acceptance unverified)
Contract: x86_use_regalloc
Acceptance: The x86 emitter keeps allocated values in their registers instead of spilling to stack homes on entry (the witness: loop counter in r12, accumulator in r13, still reloaded); done-rule: nx_probe_bchk_asm shows no home reload and the checked loop bench improves, equiv net 10/10 plus self-host GREEN -- LANDED 2026-08-23 (x86_use_regalloc, nx_x86_64_ctx.nx): the homed loop counter is compared IN PLACE (movq+cmpq scratch copy removed), main() 64->60 instrs, nx_bounds_perf checked hot loop -16.5% (8278us->6912us median); SOUND cross-block forwarding (cut-the-load-block availability, self-host-proven after a merge-unsound draft was caught and rewritten); nx_x86_regalloc_use_gate 5/5 GREEN, 3/5 RED vs banked pre-LN7; equiv 10/10+selfhost GREEN; LN1/LN2/LN3/LN8 still GREEN; promoted a21068ae both roots
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN8 — Eqsat consumed by the backend
Prerequisites: LB6 (acceptance unverified)
Contract: opt_eqsat_pass
Acceptance: The pass rewrites real IR through the e-graph under the proven rule table, queued behind the equivalence net; done-rule: x xor x folds where const_fold cannot, controls hold, byte-identical on the 13,201-source population except the rewritten sites
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN9 — Canonical formatter
Prerequisites: LB0 (acceptance unverified)
Contract: srcfmt_emit
Acceptance: Idempotent formatter over the tokenizer stream; gate proves fmt(fmt(x)) == fmt(x) and the formatted corpus builds to byte-identical binaries -- SHIPPED 2026-08-23: nx_srcfmt live and registered, nx_srcfmt_gate 13/13 GREEN, style measured from the corpus, the token-stream oracle guarantees non-mutation
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN10 — Incremental build cache
Prerequisites: LB0 (acceptance unverified)
Contract: inc_cache_lookup
Acceptance: Per-module cache keyed by the closure sha the build door already computes (the B2 cache keys whole targets); gate proves a one-file edit rebuilds only its dependents and the output equals a full build
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN11 — Language server
Prerequisites: LB3 (acceptance unverified), LN9 (acceptance unverified)
Contract: lsp_serve
Acceptance: Honest greenfield (nx_lsp.nx does not exist): diagnostics, goto-def and hover over the genealogist's code graph; gate proves initialize plus a diagnostics round-trip against a recorded client transcript
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN12 — Stepping debugger
Prerequisites: LB5 (acceptance unverified)
Contract: dbg_step_over
Acceptance: The doctor lane's DT1: break and step on our own binaries over the line table we emit (one contract, two pages)
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN13 — Capturing closures
Prerequisites: LB0 (acceptance unverified)
Contract: parse_closure_capture
Acceptance: Closures capturing by value into a compiler-emitted environment struct; gate proves a captured counter increments across calls and a capture of a moved value is refused once LN4 lands
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN14 — Qualified imports
Prerequisites: LB0 (acceptance unverified)
Contract: imp_qualified_name
Acceptance: Namespace-qualified names so two organs may export the same identifier; gate proves a shadow collision from the 2026-06-23 census compiles unambiguously with qualification
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN15 — Free multi-line expressions
Prerequisites: LB0 (acceptance unverified)
Contract: tok_line_continuation
Acceptance: A continuation line opening with a binary operator joins the previous statement instead of becoming a dead statement (the det2x2 bug class); gate proves the fixture that caused the runtime-wide sweep now computes and a lone operator line is a diagnosed error
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN16 — Working f64 arithmetic
Prerequisites: LB0 (acceptance unverified)
Contract: x86ctx_emit_f64
Acceptance: Correct SSE2 emission for f64 add sub mul div; done-rule: nx_probe_float run-exit=0 (1.5 plus 1.5 equals 3.0), deliberately low priority under the no-float doctrine
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR1 — Errors as values, enforced with propagation
Prerequisites: LB1 (acceptance unverified)
Contract: res_propagate_op
Acceptance: A dropped Result refuses (must-use) and a one-character propagation form rethrows with context; abandonment stays fail-fast (the Midori split); backfill census before enforcement; witness refuse and accept both directions
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR2 — Structured concurrency: scoped spawn
Prerequisites: LB0 (acceptance unverified)
Contract: sc_scope_spawn
Acceptance: Spawn exists only inside a scope that joins its children; child error propagates to the scope; cancellation is scoped; the orphan-task shape is unrepresentable; pool witnesses stay green
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR3 — Package lane: content-addressed, zero install-time execution
Prerequisites: None declared; this does not establish execution eligibility.
Contract: pkg_cas_resolve
Acceptance: An external module resolves by content hash with no version negotiation and no code execution at install; a planted typosquat cannot resolve; the supply-chain bet becomes a measured exceed
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR4 — Language-level capability security
Prerequisites: LN4 (acceptance unverified)
Contract: cap_root_main
Acceptance: main receives root capabilities and syscall surfaces require a capability value; a dependency demanding new authority fails to compile; extends the live ocap ops surface into the type system
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR5 — Written language specification plus conformance suite
Prerequisites: None declared; this does not establish execution eligibility.
Contract: spec_conformance_run
Acceptance: The spec documents syntax, types, memory and refusal semantics; the conformance runner drives the shipped compiler over the suite and a planted deviation goes RED (the Ferrocene lesson taken early)
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR6 — NishiOS and Nishi Browser inheritance attestation
Prerequisites: LN1 (acceptance unverified), LN4 (acceptance unverified)
Contract: oa_state_name
Acceptance: The attestation organ rebuilds the nishios kernel and browser closures under the enforcing compiler (ring on, crash guard on) and writes a receipt both compare pages cite; the Rule-of-2 unsafe-language leg is discharged by measurement
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LR7 — Sound bounds-check elision
Prerequisites: LN7 (acceptance unverified)
Contract: bck_elide_dominated
Acceptance: A dominated in-range re-check is elided ONLY under the blessed dominance oracle (an unsound elision is a silent memory-safety hole, the elision proof gate is the tooth); h2h checked lane approaches the unchecked band
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN17 — Induction-guarded bounds-check elision
Prerequisites: LN7 (acceptance unverified), LR7 (acceptance unverified)
Contract: bck_elide_induction
Acceptance: The loop guard proves the single check inside its loop under a fixed rule set (non-escaping local counter, constant resets, guarded constant steps, no store on a guard-to-access path, guard bound not above the array length); nx_bck_iv_gate GREEN with both refusal directions bite-proven, nx_cc_equiv_gate 10/10 plus self-host GREEN, then promote_toolchain and the receipt re-measured by the promoted compiler
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN18 — Checked arithmetic at add-plus-jo cost
Prerequisites: LN1 (acceptance unverified), LN7 (acceptance unverified)
Contract: x86ctx_ovf_fuse
Acceptance: The x86 emitter renders the LN1 overflow shape as add then jo (sub then jo, imul then jo) with no spills; nx_chkarith_gate stays GREEN, the equivalence net passes, and the receipt shows the daily mode within 1.3x of the default build on the accumulate loop
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN19 — Integer SIMD reduction vectorization
Prerequisites: LN8 (acceptance unverified), LN17 (acceptance unverified)
Contract: opt_vec_reduce
Acceptance: Integer reductions with a provable trip count are emitted as packed adds under the equivalence net; the receipt shows the f1 mode within 1.2x of gcc -O2 on the accumulate loop
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN20 — Loop splitting for non-implied bounds (IRCE)
Prerequisites: LN17 (acceptance unverified)
Contract: bck_irce_split
Acceptance: A guard wider than the array yields pre, main and post loops with the main loop check-free; the F2-shaped fixture still traps at exactly the first out-of-range index
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN21 — Compiler modes as declared data
Prerequisites: LN1 (acceptance unverified), LN7 (acceptance unverified)
Contract: nxcx_expand_mode
Acceptance: Every mode is a knowledge/lang_modes.conf row expanded into declared flags; an undeclared mode refuses by name; --mode=f1 is byte-identical to its bundle (gate tooth)
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN22 — One receipt arm per mode
Prerequisites: LN21 (acceptance unverified)
Contract: h2_build_nx_mode
Acceptance: The h2h receipt carries nishilang-<mode> arms built through --mode and the page renders them beside the rival compilers; nx_lang_h2h_gate GREEN
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN23 — Energy per run on the receipt
Prerequisites: LN22 (acceptance unverified)
Contract: h2_energy_arm
Acceptance: Each arm carries package energy from RAPL or a named UNMEASURABLE; the first VALID column comes from a host that exposes powercap
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN24 — A lexer desync is attributed to the file and line that broke
Prerequisites: LB3 (acceptance unverified)
Contract: diag_desync_origin
Acceptance: A raw control byte or an unterminated string literal in the LAST user file surfaces as a flood of unknown-name errors inside the auto-appended crash handler with THAT file's line numbers (MEASURED 2026-09-02: a raw NUL inside nx_inline_vec_measure_gate.nx read as twenty errors at nx_crash.nx lines 36 to 99, and the author looked in the wrong file; the control organ nx_probe_hexesc proved high-byte hex escapes ARE honoured, so only the attribution is wrong). The lexer refuses a control byte other than tab, LF and CR by file and line, and reports an unterminated literal at ITS opening line before any later file is expanded. Gate proves a planted NUL and a planted unterminated string are each named at their own file and line, and the neg-control proves a clean corpus builds byte-identical
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN25 — Compiler capacity limits are diagnostics, not asserts
Prerequisites: LB3 (acceptance unverified)
Contract: diag_capacity_named
Acceptance: nx_cc dies with nx_assert_lt idx=4096 cap=4096 tag=ir_block_new when one function exceeds the IR block pool (MEASURED 2026-09-02: a 253-name entity if-chain in nx_html_entities.nx), naming the pool and not the function, so the author cannot tell which function to split. Every capacity cap (blocks per function, same-callee call sites, module count) is reported as an error naming the function, the cap, the measured count and the remedy. Gate proves an over-cap function is named with its count and that a function one below the cap compiles unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN26 — Line tables ride every API build so a fault address resolves on the deployed binary
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hc_build_debug_armed
Acceptance: SOURCE-LANDED 2026-09-02 (nx_hostctl cmd_buildrun), supervisor rebuild queued. MEASURED: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and the instruction to rebuild with -g; by the time anyone looked the source had moved, and nx_addr2line refused the deployed binary (no .debug_line section). The toolchain already had the whole chain (nx_cc -g emits .file/.loc, nxasm builds DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line decodes it, nx_dwline_e2e_gate runs the -g ELF) and NO build path passed the flag. Now every /api/build passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, rule 17: disarm by writing 0, no rebuild). Done when a freshly built organ answers nx_addr2line with file:line for an address inside its text on the PROMOTED binary AND the byte-identity censuses (nx_gatestale, nx_artifactdrift) treat the appended table as the like-for-like they already recognise in nx_rebuild_drain
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN27 — Every diagnostic teaches: one voice with location, caret, why and fix
Prerequisites: LB3 (acceptance unverified)
Contract: diag_voice_gate
Acceptance: The parser's teaching errors already print the offending line with a caret (nx_diag_caret), then a why-the-build-stopped line and a fix line; the LN24 desync messages landed 2026-09-02 without them and the operator named the output as not helping a programmer grow to mastery. Estate-wide: every error site in the tokenizer, parser, IR, assembler and the build door carries what, where (file:line plus caret), why and how to fix, in that one voice, and the capacity asserts (LN25) join it. A gate walks every diagnostic emission site in the toolchain sources and refuses a site that prints a location without a why line and a fix line, with the positive control of the existing teaching sites passing and a planted bare location failing. Owner: the lang lane
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN28 — SIMD lane intrinsics for the quantized decode
Prerequisites: LB3 (acceptance unverified)
Contract: x86ctx_emit_q4kunpack32s
Acceptance: LANDED 2026-09-02 on the laptop toolchain (blessed through nx_bless_compiler NEUTRAL: nx_cc_equiv_gate 10 of 10 plus self-host GREEN, nx_game_gate no-regression 127 to 127, nx_tc_canary 8 of 8). __q4k_unpack32s(qs, out, sc_lo or sc_hi shl 16) turns one Q4_K sub-block pair (32 packed nibble bytes) into 64 i16 lanes already multiplied by their 6-bit scale, emitted as 14 AVX2 instructions in VEX .byte form (vpmovzxbw, vpsrlw, vpand, vpmullw, vpbroadcastw, vmovups; the mask is built from vpcmpeqd and vpsrlw so no memory constant), five toolchain sites (nx_types OP_Q4KUNPACK32S 151, nx_ir, nx_parse, nx_x86_64_ctx, nx_x86_regalloc). Proof: nx_q4k_simd2_gate 9 of 9 -- lane-exact on 5000 random blocks against the scalar spread, dot-exact on 200 real-shaped rows against BOTH incumbent rulers, two neg-controls. The family this opens: a Q6_K unpack (the 28 fallback rows at 7B), a Q8_0 widen, and a lane-wise i16 multiply-add with the scale folded, each landing the same way. Done-rule met: the emitted unpack replaces about 1.4 scalar ops per weight and the fused dot runs 3.94x faster than the scalar-unpack SIMD dot on the 14-super-block row
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN29 — A field name must belong to the struct it is read from
Prerequisites: LB3 (acceptance unverified)
Contract: parse_field_of_struct
Acceptance: A field access p.f where f is not declared by the struct type of p is refused by name; today it resolves against every struct's field table and reads another struct's offset (measured 2026-09-02: f.name_bytes on a *Function compiled and printed junk). Gate proves the fixture is refused with the struct and its real fields named, and the corpus builds unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN30 — An else with no if is refused, never run
Prerequisites: LB3 (acceptance unverified)
Contract: parse_stmt_dangling_else
Acceptance: An else that begins a statement is refused by name with where, why and fix (measured 2026-09-02: a stray else absorbing a missing brace compiled with exit 0 and ran its block unconditionally inside nx_autofix_intake_gate, counting every row twice); gate proves the silent-class and loud-class fixtures are refused by name while else-if chains and plain if/else still compile; the corpus builds unchanged
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN31 — A keyword at module level is named, not blamed on a brace
Prerequisites: LN30 (acceptance unverified)
Contract: parse_module_stray_keyword
Acceptance: A statement keyword at module level (var, let, else, return, if, while) is refused with its own cause -- var: module state is `static name: type`; let: const or static; the rest: a function above closed early -- with where, why and fix, and parsing continues to the end gate; gate proves a module-level var is refused by name and its static twin compiles
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN32 — A bare block statement is a scope
Prerequisites: LN31 (acceptance unverified)
Contract: parse_stmt_block
Acceptance: `{ ... }` at statement start parses as a scoped block: names declared inside die at its closing brace, sibling blocks may reuse a name, a leaked name is refused by name; the block fixture runs and returns its computed value; the three estate sources written with C-style inline blocks build
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN33 — wasm threads from the sovereign compiler: shared memory, atomics, wait and notify
Prerequisites: LN6 (acceptance unverified)
Contract: wat_mem_shared
Acceptance: OPERATOR 2026-09-03 (max performance from current browsers, a launch that needs no install): the served world pages already carry COOP same-origin and COEP require-corp so SharedArrayBuffer is unlocked, and nothing spends it because the sovereign wasm backend emits no threads -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify, SharedArrayBuffer named only in a router comment. Done when nx_wasm and nx_wasm_scalararm emit a shared memory with a declared maximum plus the 0xFE-prefixed atomic loads, stores, rmw ops, wait and notify for i32 and i64, nx_compile_wat lowers them, NishiLang surfaces them as an atomic intrinsic family beside the LN6 send marker (a struct shared across Workers must be send-marked or the compiler refuses by name), and a gate instantiates the module in the sovereign VM twin AND in a browser over the CDP wire with two Workers incrementing one shared counter without loss, the neg-control being the non-atomic add that loses increments; the GE27 digest tooth then reads the threaded frame bit-identical to the single-thread frame. Consumers: gameengine GE30 (tiles across every core) and performance PF13 (the tick off the render thread)
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN34 — The same atomic names lower to hardware on the native lanes: LOCK-prefixed x86-64, rv64 AMO, futex wait and notify
Prerequisites: LN33 (acceptance unverified)
Contract: rv_home_t6
Acceptance: OPERATOR 2026-09-03 (scale from a sensor to a supercomputer, the browser is never the ceiling): the __atomic_* builtins (nx_atom.nx) lower to OP_ATOMIC_*: LOCK on x86-64 (pre-existing), 0xFE on wasm (LN33), lr/sc + AMO on rv64 (LN34 source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim and on the NAS); done when nx_x86_64 lowers nx_atomic_add32 and family to LOCK xadd, cmpxchg, xchg and mfence, the rv64 backend to amoadd, amoswap, lr and sc and fence, nx_atomic_wait32 and notify to the futex syscall on Linux and to the NishiOS kernel wait queue, all behind the SAME call names the wasm lane intercepts (one source, three lowerings), proven by a two-worker nx_pool counter that loses ZERO increments natively where the reference bodies lose some (the same lost-update neg-control the browser proof used), plus the LN6 send-marker refusing an unmarked struct shared through them
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN35 — memory64: the wasm32 4 GiB wall is a declared choice, never a ceiling
Prerequisites: LN33 (acceptance unverified)
Contract: wasm_memory64
Acceptance: the emitter wraps every address to i32 and the WAT compiler encodes 32-bit limits, so a world larger than 65536 pages cannot exist on the browser door; done when a module declaring `static nx_wasm_memory64_req: i64 = 1` emits `(memory i64 MIN MAX)` (the memory64 limits flag), every load, store and atomic drops the i32 wrap, the mmap helper grows in i64, the WAT compiler and the VM twin carry the flag, a module past the wasm32 ceiling instantiates in a memory64 browser over the CDP wire, and a module WITHOUT the declaration still emits wasm32 byte-identical to today
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN37 — An f64 ordered compare of a single-use loaded operand is correct
Prerequisites: None declared; this does not establish execution eligibility.
Contract: x86ctx_cmp_f64_operands
Acceptance: LANDED 2026-09-03. The f64 compare emitter cleared the G1 op0-in-rax fact BEFORE the operand loads, so a G4-elided operand was re-read from a slot nothing wrote and tripped .G4_elided_slot_load_bug on any f64 ordered compare of a loaded value; the clear now happens after the ordering-key transform. Toolchain 6cf44630 canary GREEN.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN38 — A NaN operand compares unordered: every ordered predicate false, only != true
Prerequisites: LN37 (acceptance unverified)
Contract: x86ctx_emit_f64_nan_guard
Acceptance: LANDED 2026-09-03. The ordering-key transform made a NaN a total order so n != n read false and a sign-set NaN sorted below every number; an integer-only guard (exponent 2047 and mantissa nonzero, no ucomisd needed) now forces the IEEE-correct flags. Proven by nx_f64_gate 27 of 27 GREEN and bite RED against the pre-fix compiler.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN36 — Decimal exponent float literals
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lex_number_exponent
Acceptance: OPEN. lex_number in nx_tokenizer accepts a fraction and f32 or f64 suffixes but has no exponent form, so 1e-9 does not lex; today such constants are spelled in full decimals. Cheapest of the three literal gaps.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN39 — Float and f64 constant-expressions
Prerequisites: None declared; this does not establish execution eligibility.
Contract: const_eval_f64
Acceptance: OPEN. const_eval_primary in nx_parse accepts only integer literals, so const X: f64 = 0.5 is refused; today f64 module constants are written as zero-argument functions.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN40 — A large-fraction literal is refused, never looped on
Prerequisites: None declared; this does not establish execution eligibility.
Contract: fp64_from_parts_bounded
Acceptance: OPEN. A 20-digit fraction overflows the exact-rational packer in nx_quant (10 to the 20 exceeds i64) and the compiler loops instead of refusing; today tiny values like 1e-20 are built by multiplying representable literals.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN42 — nxasm_x86 assembles .data so a NON-ZERO writable static initializer works on both lanes
Prerequisites: None declared; this does not establish execution eligibility.
Contract: axc_apply_section
Acceptance: THE BUS STOP UNDER LN36, SPECIFIED FROM THE SOURCE RATHER THAN LEFT AS A COMPLAINT. Today a writable static may only be ZERO-initialised: x86ctx_emit_module_globals emits a loud invalid line for any non-zero one because .rodata is read-only on the GNU lane and nxasm maps .data (and .bss) to section id 2 = IGNORE (axc_apply_section, nxasm_x86.nx:1051-1064). But nxasm's section 1 tail is ALREADY WRITABLE -- that is exactly how .lcomm works, and its own comment says 'zero-filled MUTABLE slot ... our single-image model appends to the data tail' -- so .data is a both-lanes-correct emission that was simply never taught. Done when: axc_apply_section maps a bare .data and .section .data to section 1; x86ctx_emit_module_globals emits .data + .Lg<id>: + a .byte list for writable non-zero globals in a SECOND pass after the rodata stream (so output stays byte-identical when no such global exists, which nx_cc_equiv_gate proves); a gate compiles a fixture with static x: i64 = 42, WRITES to x and reads it back, with a neg-control that the pre-fix compiler refuses it; and the toolchain promote is canaried. Unblocks the three organs already carrying the workaround by name (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib) and every future dual-target module
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN41 — The wasm memory is declared on the BUILD LANE so one source builds at a sensor's memory and at a supercomputer's
Prerequisites: LN33 (acceptance unverified)
Contract: watd_atoi
Acceptance: LANDED 2026-09-03. LN33 let a module declare its memory with statics; a DUAL-TARGET module cannot, because the native lane refuses a non-zero static initializer by name, and it should not have to -- a target's limit is a declared door on a ladder, never a constant in the source. nx_compile_wat --shared <pages_req> <pages_max> moves it to the build lane, --nothreads emits the unshared twin at the same declared size, and absent the flag the WAT is byte-identical. nx_wasm_threads_gate 37/37 GREEN on the NAS; driver promoted 6c6f5f4d, gate promoted 1895335d.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN43 — Bounds-check elision with a cost model
Prerequisites: LR7 (acceptance unverified)
Contract: bck_elide_cost_model
Acceptance: The modulo arm of nx_bck_elide_gate is GATED rather than merely published, elision is DECLINED on shapes that measure slower, and the div-free win is preserved at or above 1.9x across three sequential rounds on the live compiler
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN45 — An unclosed brace is reported where it was opened
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nxcx_brace_balance
Acceptance: LANDED 2026-09-03. A single missing closing brace made every later declaration parse INSIDE that block, so the module-level const on line 2 of nx_crash.nx -- the crash handler the builder APPENDS to every program -- read as an assignment and the whole cascade was attributed to a file the author never wrote. The driver now walks the TOKEN stream after lexing (so a brace inside a string or comment cannot confuse it), remembers the OUTERMOST still-open brace, and refuses with a caret on it, the depth, and the reason the errors would otherwise surface elsewhere. A stray closer gets its own message.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN44 — The build lane declares its compile mode
Prerequisites: LR7 (acceptance unverified)
Contract: cb_mode_policy
Acceptance: The mode organs are compiled with is DATA read by the build lane, not an omission; a target moved to the f1 bundle is proven output-identical by nx_behaveprobe before the move, and the published h2h receipt shows the default arm closing on the f1 arm
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN46 — Every parser refusal carries a location, a caret and a fix
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_pd_line
Acceptance: LANDED 2026-09-03. parse_die and two sibling raw-write refusal sites printed a bare one-line sentence with no file, no line, no caret and no fix -- 35 call sites in all. nx_diag_organ_at had existed since the file-attribution pass, waiting for a line number that parse_die never had. Every token in the unit passes through advance_tok, so recording line and col at that ONE chokepoint gives every site a truthful location without touching a single call site; a site reached before any token was consumed keeps the bare form rather than pointing at line 0.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN13a — The wat lane refuses what it cannot lower
Prerequisites: LB0 (acceptance unverified)
Contract: wat_die_unlowerable
Acceptance: LANDED 2026-09-04. The precondition under LN13, and it is worth a rung on its own because it closes a silent-miscompile class that existed with no closures anywhere. The wat backend answered an IR opcode it had no arm for with a WAT COMMENT and return 0, without storing a result local, so the module assembled, instantiated and RAN while computing zero at that instruction. Only 41 of the 141 declared opcodes have an arm in that emitter and OP_CALL_INDIRECT 144 was one of the 100 that did not, which is what every function-pointer call lowers to. Done when a function-pointer call through nx_compile_wat is refused BY NAME with its opcode number and emits no module, an ordinary direct call still compiles byte-identically, and both are bound in a gate that goes RED against the pre-fix binary.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN — Board-level journal anchor for lang
Prerequisites: None declared; this does not establish execution eligibility.
Contract: -
Acceptance: BOARD-LEVEL JOURNAL ANCHOR, DECLARED 2026-09-04. This board already journals 5 log rows against the id LN, meaning the entry is about the BOARD rather than about one rung. The .plan schema says a log row's third field is a rung id, so until this row existed every one of those entries resolved to nothing and a session inheriting this board read a ledger pointing at an address that was never declared. Declaring the anchor is the additive fix: it changes no existing row, it makes the convention READABLE instead of implicit, and nx_board_idref_gate now resolves those entries instead of counting them as dangling. Journal board-wide findings here; journal rung work against its rung.
Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
autodev — Cross-domain journal anchor: autodev entries recorded on this board
Prerequisites: None declared; this does not establish execution eligibility.
Contract: -
Acceptance: DECLARED 2026-09-04 by nx_board_idref_gate. Two log rows on THIS board are addressed to the id autodev and describe work in the autodev DOMAIN, not in lang: they record nx_autofix_intake_gate going RED 3 of 5 to GREEN 5 of 5. They are also an EXACT DUPLICATE PAIR at the same epoch with identical text, which is the signature of a double-applied append rather than two findings. Declaring the anchor is additive and makes them resolvable instead of dangling; it does NOT make them correctly filed. THE OWNING LANE SHOULD RE-JOURNAL THAT FINDING ON THE AUTODEV BOARD against a real autodev rung, after which this anchor can be retired through nx_retire_path. Nothing is deleted here on purpose: history is additive and a mis-addressed record still is a record.
Authored effort: 0. Executor kind: Board. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN47 — Every cross-tree refusal figure is scoped by CLOSURE identity, not leaf identity
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lc_closure_scope
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04, before the organ exists. The census resolves each program's transitive imports the way the builder does (_hdl_build/ first, then runtime/) and stamps every ERR row PROVEN or UNPROVEN by whether EVERY file in the closure is byte-identical to the estate manifest, not merely the erroring file. Done when: the organ reproduces the hand-computed partition of 2026-09-04 (135 proven, 119 unproven, 30 excluded, summing to 284) from the same two inputs, AND a planted stale import under a byte-identical leaf moves that row from PROVEN to UNPROVEN. The second half is the anti-vacuity tooth: a scoper that never demotes a row has not been shown to fire.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN48 — A fixture that MUST NOT compile declares it, so a refusal census can tell a control from a defect
Prerequisites: None declared; this does not establish execution eligibility.
Contract: lc_expect_fail
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Every mainstream toolchain declares negative tests in the fixture -- rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck -- and the estate has no equivalent, so its compile-refusal worklist contains rows where fixing them destroys the control. Done when: a declaration field exists and the census partitions expect-fail from defect MECHANICALLY, the 7 fixtures found on 2026-09-04 by their own prose are all declared, AND at least one fixture that carries no marker phrase (z.nx and the _nxiq_ family are the known cases) is caught by the declaration and would have been missed by the vocabulary scan. That last clause exists because the 7 is a FLOOR and a mechanism that only reproduces the floor has added nothing.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN49 — Compiler diagnostics are GRADED against a known-bad fixture set, not asserted
Prerequisites: LN46 (acceptance unverified)
Contract: cc_diag_grade
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The shipping compiler already emits the three-part shape Elm set the bar for -- a caret line, a why-the-build-stopped clause and a fix clause -- and names the enclosing construct, but NONE of that is measured, so the quality claim on this board is an assertion. Done when: a fixture set of known-bad programs with expected span and expected suggestion is scored for span accuracy and suggestion correctness, the score is PUBLISHED on this page rather than claimed, and a deliberately regressed diagnostic (a refusal stripped of its caret) lowers the score. Carries its own negative control by construction.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN50 — One diagnostic object feeds a nested terminal renderer, a machine sink and a socket stream
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_diag_object
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The same object renders through all three emitters [@gcc16] [@rustc-annotate]; a planted nested child must appear in all three; the machine sink validates against the pinned schema (LN56).
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN51 — A renderer swap is adjudicated by byte-diff count over stored snapshots of every census refusal
Prerequisites: LN50 (acceptance unverified)
Contract: lc_diag_snapshot
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Snapshot per refusal over the whole census, count printed [@rustc-annotate]; a renderer that drops a nested child must show at least one differing snapshot; an identical renderer must show zero.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN52 — A known-bug row is refused without an issue id and goes RED on unexpected pass, distinct from ignore
Prerequisites: LN48 (acceptance unverified)
Contract: lc_known_bug_id
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Parse refusal without an id [@rustc-directives] [@llvm231]; fixing the planted bug must turn the row RED; rows per class printed so zero of zero cannot read green. Extends LN48.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN53 — After a toolchain change every downstream source is rebuilt and the receipt partitions results with a named spurious reason
Prerequisites: LN47 (acceptance unverified)
Contract: lc_rebuild_partition
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Partition regressed, fixed, spurious-regressed, spurious-fixed, unchanged sums to the population [@crater159343] [@fedora45]; a planted admission refusal lands in spurious with its reason; a retry lane re-runs only changed rows.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN54 — Three optimisation passes emit certificates an independent checker accepts over the whole census
Prerequisites: None declared; this does not establish execution eligibility.
Contract: opt_pass_certificate
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Unreachable-code, dead-assignment and constant-fold certificates checked by code shared with no pass, count printed, self-host rebuild still byte-identical [@rinard10x] [@compcert318] [@brack]; a mutant that folds one constant wrongly is refused naming pass and site.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN55 — A missed-peephole candidate is scored sound and profitable on two printed axes
Prerequisites: None declared; this does not establish execution eligibility.
Contract: opt_peephole_bench
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Sound by the equivalence probe, profitable by instruction count [@peepholebench]; an unsound profitable rewrite reports REJECTED, never one of two.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN56 — Every machine-readable diagnostic validates against the pinned SARIF 2.1.0 schema, SKIP when the validator is absent
Prerequisites: LN50 (acceptance unverified)
Contract: cc_diag_schema
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Schema mirrored and pinned [@sarif-tc] [@gcc-sarif-schema]; a planted malformed diagnostic is refused by field name; removing the validator yields SKIP, never GREEN.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN57 — The register allocator backtracks on spill pressure and is fuzzed with generated functions against the naive allocator
Prerequisites: None declared; this does not establish execution eligibility.
Contract: x86_regalloc_backtrack
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Behavioural equality over a printed count of generated functions [@regalloc3]; a planted mis-assignment is caught by the fuzz lane; depends on the allocator watch x86_use_regalloc.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN58 — Saturation is bounded acyclically with the bound as data and a stochastic control finds no rewrite the bounded form misses
Prerequisites: None declared; this does not establish execution eligibility.
Contract: eqsat_bounded_acyclic
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Bound in a conf row [@egraphs2026]; the stochastic control and the bounded run agree on the census subset, counts printed; a bound of zero must be refused as vacuous.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN59 — Mutators are extracted from the estate own compiler-defect rows and replayed through the fuzz lane
Prerequisites: None declared; this does not establish execution eligibility.
Contract: sp_mutator_from_bug
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Each mutator names the defect row it came from [@issuemut]; a replayed mutator must reproduce its origin defect on the pre-fix binary and pass on the fixed one; prerequisite: defect rows carry their triggering input.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN60 — Every pool, cap and buffer in the toolchain is DERIVED from its input or carries its evidence -- a declared number without a reason is a defect of the language shape, not a tuning
Prerequisites: LN49 (acceptance unverified)
Contract: count_global_tokens
Acceptance: DONE-RULE PRE-DECLARED 2026-09-05 (operator, same day: numbers need evidence on why they are set or need to be dynamic, no guessing; this belongs to the NishiLang shape and theory with research and reasoning as of September 2026). MEASURED CAUSE: parse_module derived its FUNCTION pool from counted func tokens after a 256-slot pool corrupted nxc.nx twice (T#selfhost-004/006), but kept a DECLARED 4096 for the GLOBALS pool behind a comment claiming it could not be derived -- and on 2026-09-05 the nx_wgsl unit (shader front-end + both backends + the world and cast shaders) reached 4097 and the build stopped at the guard. It CAN be derived: every global is anchored to a TK_STRING, TK_STATIC, TK_FLOAT/TK_FLOAT_F32 or TK_FUNC token, so the bound is that sum plus a NAMED slack for backend-synthesised entries, wrong only in the direction of surplus (address space never faulted in). THEORY, as of Sept 2026: a bound is a claim about the input; a claim with no witness is a guess that fails in silence when the input grows past the day it was typed, and the estate has now paid for that three times in ONE file. The language shape is therefore: (a) a pool is sized by a pass over the thing it will hold; (b) where the size is genuinely unknowable in advance (a network body), the bound is NAMED for that one purpose and its exhaustion ANNOUNCES; (c) a const that sizes anything carries, in its own comment, the measurement or the spec it came from, so a reader can re-derive it. Done when: (1) count_global_tokens lands, nx_wgsl builds past 4096 and the guard stays armed (a planted under-count refuses BY NAME, bite-proven); (2) a census organ walks the toolchain closure (nx_types, nx_lex_kinds, nx_tokenizer, nx_parse, nx_ir, nx_opt, nx_x86_64_ctx, nxasm_x86, nx_compile_x86) and lists EVERY const that sizes a pool, cap, buffer or table with a derivation class -- DERIVED-FROM-INPUT, EVIDENCED (the adjacent comment names a measurement or a published spec) or BARE -- published on this page, BARE ratcheting to zero; (3) the research is fetched, pinned and cited (candidate sources to fetch, NOT yet citations: Zig std allocator and ArrayList growth, Rust Vec amortised growth and the RFC on capacity overflow, LLVM SmallVector, the Go slice growth policy, plus the estate's own three pool incidents as the measured cost) so the principle is a written part of the NishiLang shape rather than a memory
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN61 — Verifier-in-the-loop compiler door
Prerequisites: LB0 (acceptance unverified)
Contract: vl_retry_until_green
Acceptance: The September-2026 shape for making a weak or local model produce correct programs in a language it does not know. Eiffel-tools [@eiffeltools-2609-03086] pairs a language server with a STATIC VERIFIER and retries until the program verifies, fixing 76 to 95 percent of bugs across two datasets and three models, and the verifier is what carries the correctness rather than the model. We already own the harder half: nx_cc refuses, and the gates decide. What is missing is a MACHINE-READABLE refusal plus a retry protocol a weak engine can drive without a frontier model in the loop, so that compiler refusals become a control signal instead of prose a human reads. This is the highest-leverage rung on the board because it converts all future organ authoring from frontier-token work into local work, and organ authoring is currently the frontier seat's entire residual against the 96-new-token local ceiling. Done-rule: a local engine reaches a declared first-try-green rate on a held-out organ set, measured by the incumbent nx_build_firsttry_lib and not by a new ruler.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN62 — The estate as a retrieval-time tool catalogue with a router
Prerequisites: LN61 (acceptance unverified)
Contract: tp_route_primitive
Acceptance: HEART [@heart-2609-01736] is this estate's own thesis measured by someone else, and its full text is stronger than its abstract: the backbone is Qwen3-8B, an 8B OPEN model, driving Planner, Router, Verifier and the Tool Primitives themselves, reaching 84 percent task completion on 50 real-world tasks against GPT-5.4 at 20 and Claude-4.6-Sonnet at 24, at up to 7.4 times lower API cost, and HEART on Qwen3-8B matches the GPT-5.4 hybrid on most metrics at over 12 times less cost. Two design points transfer directly. Tools are wrapped so SCHEMA RESOLUTION HAPPENS INSIDE THE TOOL rather than by enumerating raw API schemas in the caller's context, and the orchestration layer and the execution layer scale INDEPENDENTLY. We already hold the catalogue of roughly 940 registered tools, the retriever in nx_capsearch, the Verifier in the gate fleet and a Planner in nx_goalmap and nx_compare_rank. The thin part is the ROUTER and the natural-language tool wrapper. Done-rule: a local engine completes a declared task set through the router at a measured cost ratio against the frontier path, with the ratio published beside the completion rate so a cost win that loses quality is visible as a regression.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN63 — Test-time generate-evaluate-refine for organ authoring
Prerequisites: LN61 (acceptance unverified)
Contract: gc_refine_round
Acceptance: GenCorrect [@gencorrect-2609-02849] decomposes cleanly in full text and the decomposition is the argument: Nemotron-3-Nano-CC at 3B ACTIVE parameters goes 130 to 280 after SFT to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, past the 438.3 gold threshold. Post-training bought 161 points and the test-time loop bought 177, and the Ultra model gained 198 points from the loop with no code-specific RL at all. The transfer is exact: propose N organ candidates, run the GATE on each, refine from the gate's own output, repeat within a declared round budget. The estate already owns every piece except the loop itself, in nx_gate_bite and nx_sov_build_run with build-only. This is the direct answer to the 96-new-token local ceiling, because the loop trades ROUNDS for parameters rather than needing a bigger model. Done-rule: a declared organ set is authored to gate-green by a local engine within a named round budget, with the round count and the budget both published, and a neg-control organ that must NOT reach green.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN64 — A compact model-facing view of the IR
Prerequisites: LN61 (acceptance unverified)
Contract: mir_emit_compact
Acceptance: PrEx [@prex-2609-00579] settles what NOT to build here: models lean on pre-training priors rather than applying semantics handed to them, and are WORST under KeywordSwap and KeywordObf, the shifts where familiar symbol meanings must be overridden. NishiLang is exactly that case and worse, because it resembles C without matching it, so a model's priors are ACTIVELY WRONG rather than merely absent, and the failure direction is the flattering one since models frequently declare invalid programs executable. So no spec-stuffing and no fine-tuning rung will be opened on this board. What DOES transfer is representation: measured on a quantized local model, a compact control-flow representation fit the context where the AST overflowed, and REPRESENTATION CHOICE BEAT MODEL SIZE. We already have an IR. Emit a compact model-facing VIEW of it so the local ceiling rises without anyone claiming the model understands the language. Done-rule: the view is emitted from the existing IR with no second IR created, and a declared task set measures higher local first-try-green with the view than without it, the comparison run on the same engine.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN65 — Population-complete research currency, mechanically verified
Prerequisites: LB0 (acceptance unverified)
Contract: ac_census_complete
Acceptance: The sotabar and barscan law needs an attestation that a month's listing was actually READ, and until now that attestation was a seat's word. nx_arxiv_census composes the incumbents rather than duplicating them, taking se_fetch from nx_search_extern and em_int_after with em_collect_yms and em_maxym from nx_search_emerge, and asks the ONE question neither incumbent asks: does opensearch:totalResults reconcile against the entries actually delivered. Equal means the window is a POPULATION and an absence claim over it is sound; fewer means a SAMPLE wearing a population's clothes and absence over it is UNPROVEN. This is what converts the measured zero behind sb-slm-code-whitespace from an assertion into a verdict, and it also produces the barscan newest= field mechanically via em_maxym. The currency control for the agent bar is the SWE-bench listing [@arxiv-swebench-2026-09]. Done-rule: the organ exits COMPLETE on a window whose counters reconcile, CAPPED on one where max_results truncates the population, and a bite plants a deliberately truncated window that MUST be named CAPPED rather than passing.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN66 — The dot builtins lower on every door
Prerequisites: LN33 (acceptance unverified)
Contract: wat_lower_q8blkdot
Acceptance: __i16_dot and __q8blk_i16dot (OP_I16DOT, OP_Q8BLKDOT) lower only in nx_x86_64_ctx today, so a source that composes them cannot be built for the wasm or rv64 doors; the ONE SOURCE, MANY DOORS order (2026-09-03) requires a lowering on each door: nx_compile_wat lowers both ops to i16x8 and i32x4 SIMD where the profile has v128 and to a plain loop under --nothreads or a v128-less profile, the rv64 emitter lowers to a scalar loop first (the vector extension later), and the feature program _q8blkdot_minrepro.nx must exit 0 on every door it is built for. DONE-RULE: nx_cc_equiv_gate's feature leg runs the minrepro through the wat door in the estate wasm VM (nx_wasm_vm_verify) and through nx_rv64_sim with exit 0 on both, and the widest-block and most-negative-block answers are byte-identical on all three doors; a door that lacks the lowering must REFUSE the op by name at compile time, never emit a silent zero
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN67 — Superiority scorecard: every axis measured against every rival
Prerequisites: LN22 (acceptance unverified)
Contract: ls_scorecard
Acceptance: An organ composes the incumbents (nx_lang_h2h for speed with its checksum, the build lane for compile time and binary size, the Energy-Languages method for energy, the safety-class census, the graded diagnostics of LN49, the tooling-ring rows) into ONE receipt per rival per axis reading WIN LOSE TIE or UNMEASURED with the number beside each, rendered on the board and appended to a spine so the climb is a trajectory; the gate proves a planted loss cannot read WIN and an unmeasured axis cannot read TIE; PRE-DECLARED: the first receipt reads LOSE on speed, because the 2026-09-01 h2h bench measured NishiLang checked at 3.33x gcc -O2 and 1.6x Rust checked, and that number is the first bar to beat
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
LN68 — Rival release bars as data on a beat
Prerequisites: LN67 (acceptance unverified)
Contract: ls_rival_bars
Acceptance: The four release pages are fetched monthly, the current versions parsed into a pinned bar row, so every WIN or LOSE names the rival version it was measured against; the gate proves a planted version change flips the bar and an unchanged page leaves it
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 59 feature rows mapped of 97 matrix rows; 38 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/lang.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 500–1000, distinctiveness 50–350 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 645 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 500–1000 · distinctiveness 50–350 · breadth 200–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 3 (a fact of the data: two players that close are that close) · data spread 122 permil of the plot

Nishi Rust Zig Go Elm
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 5 (a fact of the data: two players that close are that close) · data spread 544 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	826	283	491	690	-18 since 2026-09-21	42	8	2026-09-15
Rust	Aspirational	968	264	576	739	+3 since 2026-09-21	46	8	2026-09-15
Zig	Mainstream	900	205	485	699	+6 since 2026-09-21	41	8	2026-09-15
Go	Peripheral	815	189	423	694	+8 since 2026-09-21	36	8	2026-09-15
Elm	Peripheral	605	113	282	666	+11 since 2026-09-21	25	8	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	95	5
2026-09-16	95	5
2026-09-17	95	5
2026-09-18	58	5
2026-09-19	58	5
2026-09-20	58	5
2026-09-21	58	5
2026-09-22	58	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790056558, gate census asof 1790017637 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 388, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Rust	Zig	Go	Elm
SIMD lane intrinsics for the quantized LLM decode (nibble unpack and scale, i16 multiply-add) Source present; authored stronger claim: `x86ctx_emit_q4kunpack32s` in `runtime/nx_x86_64_ctx.nx`, verified at emit. LANDED 2026-09-02 (lang LN28): __q4k_unpack32s emits 14 AVX2 instructions that turn a Q4_K sub-block pair into 64 scale-multiplied i16 lanes, beside the existing __i16x16_madd and __q5_unpack32; proven lane-exact and dot-exact (nx_q4k_simd2_gate 9 of 9) and 3.94x over the scalar unpack. Rust and Zig expose lane intrinsics (std::arch, @Vector); Elm has none; Go reaches SIMD only through hand-written assembly. EXCEED: the intrinsic is specified as exact integer arithmetic with a bit-exact gate, so a quantized decode built on it is deterministic across hosts rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	●	○	◐
Self-hosted sovereign compiler (native x86-64 ELF) Measured: `func main(argc` exists in `runtime/nx_compile_x86.nx`, verified at emit. Self-hosts through nx_cc_sovereign.elf; equiv gate 10/10 GREEN + self-host gen2/gen3 (blessed 2026-07-07); Elm compiler is Haskell-hosted rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Optimization pipeline (const-fold SCCP mem2reg GVN CSE LICM DSE DCE) Measured: `func opt_gvn_block` exists in `runtime/nx_opt.nx`, verified at emit. About O1-class today; LICM correctness-gated; Rust rides LLVM full O3 depth rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=51 nonval=47` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	●	●	●
Generics + monomorphization Measured: `instantiate_generic_n` exists in `runtime/nx_parse.nx`, verified at emit. Full monomorphization port landed; Go added generics in 1.18 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Sum types + pattern match Measured: `parse_stmt_match` exists in `runtime/nx_parse.nx`, verified at emit. Payload ctor and match probes re-verified run-exit=0 (2026-07-09, earlier SIGSEGV fixed by the 07-07 bless); Go lacks sum types; Elm ADTs are the bar rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	○	◉
Threads / parallel runtime Measured: `nx_pool_submit` exists in `runtime/nx_thread_pool.nx`, verified at emit. Ring-arena pool, measured 7x pooled speedup (2026-07-06 gate); Go goroutines lead; Elm has no threads rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=46 nonval=27` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Go (leads)	●	●	●	◉	○
Bounded-loop safety primitives (JPL Rule 2) Measured: `nx_loop_begin` exists in `runtime/nx_loop.nx`, verified at emit. nx_loop watchdog and settle primitives; peers leave loop bounds to external lint standards Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○
WebAssembly target Measured: `wat_emit_module` exists in `runtime/nx_wasm.nx`, verified at emit. Own .nx to .wat to .wasm chain (nx_wat_compiler); Rust wasm ecosystem leads; Elm targets JS only rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	●	●	○
RISC-V target Measured: `func materialise` exists in `runtime/nx_riscv.nx`, verified at emit. Second native backend; the linear-scan allocator (nx_regalloc, Poletto-Sarkar) is wired HERE, not x86 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=12 nonval=11` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
In-repo compiler fuzz generator Measured: `sp_atoi` exists in `runtime/nx_shapeprobe.nx`, verified at emit. Shape-axis generator found a real nx_cc bug (about 1500 early-exit blocks = empty .s, 2026-07-05); peers rely on external fuzzers (rustlantis, go-fuzz) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	◐	◐	◐	○
Differential EMI oracle on the compiler gate Measured: `eq_build` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Baseline-vs-challenger build+stdout byte-equal + self-host stage; gate 10/10 GREEN (2026-07-07); born catching a silent optimizer miscompile rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	◐	◐	◐	○
Per-function miscompile bisector Measured: `sb_try_franken` exists in `runtime/nx_cc_splice_bisect.nx`, verified at emit. Function-splice frankenbuild names the breaker function; Rust cargo-bisect-rustc bisects nightlies, not functions rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: source exists, never compiled: /api/build it	●	◐	○	○	○
Compiler health witness, autonomously driven Measured: `run_argv` exists in `runtime/nx_cc_health.nx`, verified at emit. Generate-build-verify witness; nx_exec_engine drove it 3/3 GREEN autonomously (2026-07-06) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	●	●
Never-brick compiler bless (equiv-gated install + rollback) Measured: `bc_equiv_green` exists in `runtime/_hdl_build/nx_bless_compiler.nx`, verified at emit. Refuses install unless differential equivalence is GREEN; byte-identical corpus check rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-UNAUTHORISED` — PARTIAL: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Equality-saturation engine Measured: `nx_eqsat_union` exists in `runtime/nx_eqsat.nx`, verified at emit. BUILT AND GATE-PROVEN FOR THE FIRST TIME 2026-08-14, and it took two real fixes to get there. (1) THE ENGINE DID NOT COMPILE: NX_EQSAT_W was declared 470 lines below its first reader, and nx_cc refuses that because the reader would silently see 0 -- which would have inverted every shift-width soundness guard and fired the mul-to-shl rewrite exactly where nx_rule_soundness proved it UNSOUND. Nobody had noticed because a leaf lib is never built directly and all 10 importers were unbuilt too. (2) TWENTY-SEVEN CALL SITES ALLOCATED TOO FEW BYTES FOR NxEGraph: the struct has grown to 35 fields = 280 bytes, and the sites asked for 128, 256 or 96 -- not one asked for 280. Everything from hc (offset 128) onward, which is the entire meet, DSL, const-fold and match-worklist state these very proofs certify, was written OUT OF BOUNDS; the 96-byte sites overran by 184. CORRECTION TO MY OWN FIRST NUMBER, published here earlier today as nine sites across five files: that was the population of ONE SPELLING. The first sweep grepped the literal `sys_mmap(128) as NxEGraph` and missed the 256 and 96 variants entirely, including the worst of them. A SWEEP THAT MATCHES THE WRONG VALUE REPORTS A CLEAN POPULATION AND LEAVES THE WORST SITES LIVE -- the honest scan keys on the CAST (`as NxEGraph`), not on the size. What actually surfaced the miss was the arena's own ring detector: nx_eqsat_dsl_parity_test printed ARENA-OVERRUN prev_alloc_size=256 eight times WHILE REPORTING 15/15 GREEN, which is why a green verdict is never a substitute for reading the output. All 27 sites now derive from NX_EQSAT_GRAPH_BYTES (corpus_complete=1) and the same gate re-runs 15/15 with ZERO overruns. Three comments in the struct asserted page-rounding made the new fields fit; that stopped being true when NXA_SMALL_MAX moved 64->256 on 2026-08-07, the identical ARENA-OVERRUN prev_alloc_size=128 signature recorded in rv64im_min_sim.nx:111. Now sized by NX_EQSAT_GRAPH_BYTES. RESULTS -- SEVEN GATES, 93 TEETH, ALL FIRST RUNS EVER: nx_eqsat_membership_proof_test 22/22 GREEN (membership-as-proof certificate over a 3,584-vector battery against FOUR load-bearing controls, the sharpest being the k=W boundary that a pure equality sweep is PROVABLY BLIND TO -- both sides mask to zero for every vector, so only the side-condition catches it -- plus an undersized provenance log that must fail CLOSED rather than silently drop entries). nx_eqsat_bw_witness_gate 4/4 GREEN (1,048,576-vector exhaustive mod-2^W proof of the truncation semantics every other rule rests on; it was labelled a throwaway witness, had never been compiled, and could not even be RUN through the gate door until renamed, since /api/gate_run admits only names ending gate/test/kat). nx_opt_eqsat_oracle_gate 13/13 GREEN and REGISTERED, bite-proven RED 9/12 on a planted mutant. nx_eqsat_constfold_test 25/25 GREEN -- the deepest of them, with FIFTEEN named negative controls including five ops the folder must REFUSE for want of a faithful oracle cell (DIV, REM, SHR because logical is not arithmetic, SAR, NEG because NOT is not negate) and the sharpest control in the family: a back-door RULE_NONE merge whose endpoints genuinely DO share a class, so membership holds, and whose certificate must still FAIL because the merge cites no proven rule. nx_eqsat_congruence_test 10/10 GREEN (egg-style deferred congruence closure, cited fail-closed provenance, plus controls proving the rebuild is load-bearing and that NEG vs NOT on the same child is never merged) and nx_eqsat_rule_proof_test 4/4 GREEN (exhaustive 256-vector triangulated proof of mul-to-shl through two independent netlist legs and an oracle, with an unsound-shift-by-4 control proving the comparison can fail). Engine present and far deeper than this note used to claim (it said union-find and constfold rules): 2026-08-14 inventory found egg-style deferred CONGRUENCE CLOSURE, a const-fold e-class analysis with an explicit refusal set (DIV, REM, SHR, SAR, NEG are NOT folded), a DATA-DRIVEN rule DSL with a general e-matcher proven behaviourally identical to the hand-written rules, and a provenance log -- carried by its own gate family (congruence, constfold, dsl-parity, membership-proof, rule-proof, bw-witness) plus four benches. Peers do not ship eqsat either. Adoption: `LIB-WIRED importers=12 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Equality saturation CONSUMED by a backend Measured: `opt_eqsat_pass` exists in `runtime/nx_opt_eqsat_pass.nx`, verified at emit. RESEARCH BAR 2026-09-01: strategy design is the open half of EqSat (EggMind, LLM-synthesised reusable strategies with a strategy DSL, proof-derived rewrite-motif caching and tractability guidance, arXiv Apr 2026) [arxiv-eggmind-2026]. THE PASS EXISTS AND REWRITES REAL IR AS OF 2026-08-14 -- opt_eqsat_pass (runtime/nx_opt_eqsat_pass.nx), gate-proven 10/10 by nx_opt_eqsat_pass_gate, registered. It builds a small e-graph per two-operand integer instruction with non-constant operands keyed on their SSA VALUE ID, saturates under the data-driven rule table plus the const-fold analysis, extracts the cost-minimal form, and folds the result when that form is a constant -- using the incumbent rewrite mechanism copied from opt_const_fold, introducing no new way to mutate IR. THE HEAD-TO-HEAD, ON ONE FUNCTION: for x xor x with x a runtime parameter, the incumbent opt_const_fold folds ZERO instructions (it structurally requires both operands constant) and opt_eqsat_pass folds ONE, to the constant 0. That gap is currently unmitigated in the shipping pipeline because opt_simplify, the peephole that would catch some of these, is BISECT-DISABLED in opt_run after a self-host miscompile. Controls: two distinct parameters are NOT folded, and OP_DIV_S is DECLINED because the gate simulator has no faithful cell for division, so the engine refuses to model it. Declared narrowness: i32 results are skipped rather than duplicating opt_const_fold mod-2^32 wrap, because a second wrapping ruler is how silent wrong values get made. THIS CELL STAYS OPEN ON PURPOSE. nx_opt_eqsat_oracle_gate (13/13 GREEN, registered, bite-proven RED 9/12 on a planted mutant) makes the engine an ORACLE OVER the shipping optimizer: over the WHOLE reachable domain -- k = 1..62, not a sample -- it checks that opt_strength_reduce and the proven equality-saturation rule agree on when x2^k becomes x<<k, and that the largest shift the optimizer can emit stays inside the region nx_rule_soundness proved sound. WHAT THAT CHECK FOUND, STATED PLAINLY: the optimizer is CORRECT. is_pow2 rejects n<=1 and a positive i64 caps k at 62, so the unsound k>=64 region is unreachable and there is no miscompile. The real defect was that this was true BY ACCIDENT OF THE TYPE and nothing asserted it -- a wider constant or an edited is_pow2 would have deleted the guarantee silently, and silent-wrong-value is the worst class this estate tracks. THE CONTRACT IS STILL OPEN BECAUSE AN ORACLE IS NOT A PASS: nothing yet REWRITES IR through the e-graph, and naming this function opt_eqsat_pass to turn the cell green would be exactly the stub-carrying-the-contract-name defect the hive law warns about. THE ADOPTION GAP, MEASURED 2026-08-14 and given a contract instead of a parenthetical. The row above is honest that the engine is not wired; nothing until now NAMED the wiring as work, so it could never appear on the hive queue. Measured over 23,073 files with coverage_complete=1: nx_eqsat.nx has exactly 10 importers and EVERY ONE is its own test, bench, proof or the superoptimizer -- nx_opt, nx_compile_x86, nx_x86_64 and nx_riscv import it ZERO times. So the estate owns a gated equality-saturation engine whose entire consumer set is its own test harness. WIRED 2026-08-23: nx_opt.nx now imports nx_opt_eqsat_pass.nx and opt_run calls opt_eqsat_pass beside opt_reassoc, LIVE (not behind a disabled constant). Witnessed in the shipping pipeline, not argued: compiling runtime/nx_eqsat_wire_probe.nx, ewp_xor_self (x ^ x, x a runtime param) emits movabsq $0 where the pre-LN8 compiler emitted xorq, and the control x ^ y keeps its xor; nx_opt_eqsat_wire_gate 5/5 GREEN on the promoted toolchain, RED 4/5 (exactly the fold tooth) on a mutant with the call removed, RED 2/5 on the pre-LN8 compiler; nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary GREEN; compile-time cost measured +26 ms on a 275-line gate and within noise on the 3.5 MB compiler unit; full-population local A/B over every top-level program shows default builds byte-identical except the rewritten sites. Added --ir-dump (per-invocation post-opt IR dump; the /tmp/nx_ir_dump marker was a host-global switch). RE-KEYED 2026-08-23: the watch organ is now runtime/nx_opt_eqsat_pass.nx, where opt_eqsat_pass is DECLARED. The board's honest ruler is a top-level func declaration (the rule nx_compare_rank applies); a call site in nx_opt.nx is not a declaration, so on nx_opt.nx this cell read LANDED on the page (the generator's substring probe) and OPEN to the ranker at the same time -- two rulers, one subject. Existence is the receipt; CONSUMPTION is the proof and it is nx_opt_eqsat_wire_gate above, not this flip. WATCHING opt_eqsat_pass. Still behind the equivalence net by design: nx_cc_equiv_gate 10/10 plus selfhost must pass before any optimizer change promotes. Adoption:* `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Energy measurement infra (RAPL) Measured: `ep_read` exists in `runtime/_hdl_build/nx_energy_probe.nx`, verified at emit. Probe reads energy_uj; zero measured Joules vs C yet (X-PERF-002 open) -- beat-C-on-energy is UNMEASURED Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. not adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	○	○	○	○
Competitive native speed vs C Measured: `x86_use_regalloc` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. RE-MEASURED 2026-09-01 BY THE SOVEREIGN BENCHMARK ORGAN nx_lang_h2h AGAINST THE PROMOTED TOOLCHAIN (nx_cc_sovereign 778,655 B): identical bounds-checked hot loop, 7 runs per arm, every arm printing checksum 31447040000 -- NishiLang checked 7,152 us median vs gcc -O2 2,148 us = 3.33x (a second independent run 7,241 vs 2,093 = 3.46x); Rust -O checked 4,371 us = 2.03x; Go 4,196 us = 1.95x; clang -O2 1,128 us = 0.53x (it vectorises the loop gcc does not). The Aug-19 laptop copy of the compiler measured 8,508 us on the same host, so the LN7 register-allocation rung is worth 16 percent on this loop, reproduced. The receipt is knowledge/compare/lang.bench (host, every toolchain version, every source and binary sha256, min and median, the exact repro command), rendered on this page as the Measured head-to-head section and refereed by nx_lang_h2h_gate, whose reader re-derives the verdict from the rows. HONEST STANDING: NishiLang is NOT a peer of gcc or Rust on this loop yet -- 3.3x gcc -O2 and 1.6x Rust-checked -- and the rung that closes most of that gap is LR7 sound bounds-check elision (the UNCHECKED NishiLang lane measured 2.02x gcc on 2026-08-14). ROOT CAUSE SUPERSEDED 2026-08-14. This note used to blame a stack-machine backend with regalloc wired only into RISC-V. Re-measured on the CURRENT compiler with an identical bounds-checked hot loop where all arms must print the same checksum or the run is void: gcc -O2 2,270us, Rust -O checked 5,041, NishiLang checked 10,237, NishiLang UNCHECKED 4,581 -- so the unchecked lane lands within 9 percent of Rust CHECKED, i.e. the raw codegen is already at the checked-language tier. Then READING THE EMITTED ASSEMBLY moved the diagnosis again: the loop counter lives in r12 and the accumulator in r13 for the whole loop, so register allocation DEMONSTRABLY WORKED, and the emitter STILL spills both to stack homes on entry and reloads the counter twice more from a register that never changed. The dominant cost is not the check and not missing phi nodes: THE BACKEND DID NOT CONSUME THE REGISTER ALLOCATION IT ALREADY COMPUTED -- FIXED 2026-08-23 (x86_use_regalloc in runtime/nx_x86_64_ctx.nx): a homed value is now read IN PLACE as a compare/binop/SIB source operand instead of being copied to a scratch register first, and a load the allocator can forward no longer takes a home of its own -- forwarding is generalised across basic blocks under a SOUND cut-the-load-block availability check (an earlier merge-unsound draft that forwarded a stale value was caught by the self-host fixpoint and rewritten, not shipped). MEASURED on runtime/nx_probe_bchk_asm.nx: the loop counter is compared in place (movq %r12,%r15 ; cmpq $1024,%r15 -> cmpq $1024,%r12), main() 64->60 instructions (--no-crash-guard) / 62->58 (guarded), and nx_bounds_perf's checked hot loop 8278us -> 6912us median over 3 runs each (-16.5%). PROVEN: nx_x86_regalloc_use_gate 5/5 GREEN and 3/5 RED (T2,T3) against the banked pre-LN7 compiler; nx_cc_equiv_gate 10/10 + selfhost GREEN; LN1/LN2/LN3/LN8 gates still GREEN on the live compiler; promoted a21068ae both roots. witness-backed by runtime/nx_probe_bchk_asm.nx rather than argued. NOTE the two figures are DIFFERENT benchmarks against DIFFERENT baselines (3.65x was vs -O0 on the paired microbench and has not been re-run), so neither refutes the other. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads)	●	◉	◉	●	○
Call arity + param-type checking Measured: `prepass_count_params` exists in `runtime/nx_parse.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14: this row published _ABSENT_ for nine days AFTER the capability shipped, because a bare _ABSENT_ is a hand-written claim that nothing re-measures. COMPILER-ENFORCED and bite-proven live 2026-08-05 through /api/build with both the refuse and the accept direction witnessed in-tree (nx_probe_arity_live.nx, nx_probe_ptrint_live.nx): call-arity mismatch, pointer-into-integer argument types, and a duplicate-definition guard, with forward references carried by pre-registered stubs whose parameter table prepass_count_params builds. Integer literals stay exempt by design (the sentinel idiom) and fn-pointer calls remain unverifiable by name. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Match exhaustiveness checking Measured: `parse_stmt_match` exists in `runtime/nx_parse.nx`, verified at emit. SYMBOL RE-KEYED 2026-09-01: n_variants is a struct FIELD (nx_parse.nx:577), not a column-0 declaration, so the one symbol ruler read this row UNGROUNDED and the evidence referee went RED on it while the capability was shipped and proven; the enforcing code is parse_stmt_match, where the non-exhaustive and unreachable-arm refusals are emitted (nx_parse.nx:5301). STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-05. EnumEntry.n_variants (nx_parse.nx:577) is filled by the variant loop and parse_stmt_match counts DISTINCT discriminants, so duplicated arms cannot fake coverage. The refusal NAMES the enum and the MISSING variants, and a second check refuses an UNREACHABLE arm citing both lines. Elm ADTs remain the bar for the surrounding type system. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	○	◉
Memory safety (bounds, ownership, use-after-free) Measured: `own_check_move` exists in `runtime/nx_ownership.nx`, verified at emit. own_check_move SHIPPED 2026-08-25 as the --ownership DECLARED MODE and LIVE on the toolchain (778,655 B, canary GREEN): a use after __move(p) is a compile error naming the dead local AND the line its life ended on, stamped capability=own-check-move. THE WATCH STAYS OPEN DELIBERATELY, exactly as LN1 LN2 and LN3 do: the default is OFF and the contract is not discharged until the per-class ratchet flips it after a clean corpus census, so flipping this cell now would light green over a contract that is still open. THE MODE CANNOT CHANGE A DEFAULT BUILD, and that is measured rather than argued: it emits no IR at all, and the positive control compiles to byte-identical assembly under both modes at 67,374 bytes. PROOF: nx_ownership_gate 19 of 19 GREEN on the PROMOTED toolchain, 2 of 19 RED on the pre-rung builder, mutation bite valid_mutants 1 killed 1 not_reached 0 with the restore byte-verified. Its first six teeth are neg-controls establishing that the gap is REAL rather than assumed -- the hazard, the alias and the double-free all COMPILE AND RUN exit 0 under the default today -- and one of them is honest about WHY: the hazard runs clean by an arena accident, not by correctness, because 64 bytes is below NXA_SMALL_MAX so the release is a no-op. THE CONTROL FOUND TWO DEFECTS IN THE GATE ITSELF and both were fixed rather than accepted: the byte-neutrality tooth passed on two EMPTY asm files (two failures agreeing read as an equivalence, inside the tooth certifying neutrality), and the refusal tooth passed on a refusal the mode did not cause, since the old builder refuses __move merely as an unknown name. Rebinding both to their denominators moved the baseline 4 of 19 to 2 of 19 -- exactly those two stopped passing wrongly. Declared floors, each named: named locals only, no cross-function ownership, var aliases unswept, loop back-edges unmodelled, and conditional moves poison exactly as Rust does. Rust borrow checker is Best; Zig runtime safety modes; Go GC plus bounds checks. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	◐	●
Rich diagnostics in the shipping compiler (caret, did-you-mean, multi-error) Measured: `nx_diag_caret` exists in `runtime/nx_parse.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-05. The note this replaced said the caret and Levenshtein UX existed only in the retired C bootstrap, on the wrong side of the sovereignty boundary. It is sovereign now: nx_diag_caret plus bounded-Levenshtein did-you-mean over calls, bare identifiers AND type names, multi-error recovery across 12 semantic sites closed by a hard end gate, and the 5W-and-H voice on the undefined-name family. It stays SILENT when nothing is near, because a wrong suggestion is worse than none. Elm and rustc remain the bar on error codes and explain prose. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Elm (leads)	●	●	●	●	◉
Closures / lambdas DARK — `runtime/nx_parse.nx` EXISTS but does not declare `parse_closure_capture`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Function pointers only (VK_FUNC_ADDR); no capturing closures. WATCHING parse_closure_capture. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching parse_closure_capture Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract, nothing on disk yet	○	●	●	●	●
Namespaces / qualified imports Measured: `imp_qualified_name` exists in `runtime/nx_import.nx`, verified at emit. File-import only; name collisions caught by lint not language (22 shadow collisions found 2026-06-23). WATCHING imp_qualified_name. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=46 nonval=44` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Language server / editor integration Measured: `lsp_serve` exists in `runtime/nx_lsp.nx`, verified at emit. SHIPPED 2026-08-25 (nx_lsp LIVE 436,114 B, registered, invoked). LSP 3.17 over stdio, framed Content-Length, served FROM THE COMPILER'S OWN FRONT END -- expand_imports plus LineMap, lex_source, parse_module -- and NEVER a second parser, which is the architecture bar rust-analyzer's own note sets and the thing that cannot be retrofitted later [matklad-ide]. Every diagnostic a user sees is the shipping caret and did-you-mean text VERBATIM, so the editor cannot disagree with the build. Analysis is fork-isolated because the parser sys_exit(2)s by design. It advertises ONLY textDocumentSync=Full, definitionProvider and hoverProvider: advertising a capability it does not serve would be the stub-carrying-the-contract-name defect, so completion, rename, references and incremental sync stay UNADVERTISED and rust-analyzer and gopls still lead there. A didChange carrying a range is REFUSED LOUDLY over window/logMessage rather than mis-applied as a full replacement. PROOF: nx_lsp_gate 19/19 GREEN on the live binary via /api/gate_run exit 0, mutation-bitten valid_mutants=1 killed=1 not_reached=0 with the twin restored and re-confirmed by hash; four neg-control teeth plus a bite-proven pairing cell that fires on bad input and stays silent on good, since either half alone is passable by a server that always, or never, reports. Measured: bad_diags=1 at line=2 character=17 against a DERIVED expectation, utf16_character=47 from byte_column=50 (so the wire really is UTF-16 as the protocol requires, not bytes), frames=6, server_exit=0. It extended nx_json_lib to one de-escaper with two contracts rather than forking it, because the incumbent flattened newlines and tabs to spaces for TSV safety and would have silently destroyed a document buffer. RESIDUAL NAMED: imports are read from disk, so an unsaved edit in one file is not seen while analysing another (no VFS overlay), and documentSymbol is deliberately not shipped though its index exists. IT ALSO FOUND A DEFECT IN THE COMPILER AND THAT FIX SHIPPED: nx_parse.nx wrote the function name to fd 2 for every function of every compile with no newline, gluing the first diagnostic of every build to it and taking this very gate to 13/19 RED with a perfect diagnostic sitting in the artifact -- removed 2026-08-25, measured at 62 to 82 percent of all compiler stderr. Adoption: `RUN-BY:fork:nx_lsp_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Go (leads)	●	◉	●	◉	●
Canonical source formatter Measured: `srcfmt_emit` exists in `runtime/nx_srcfmt.nx`, verified at emit. SHIPPED 2026-08-23 -- nx_srcfmt (srcfmt_emit) formats over the tokenizer stream and REFUSES via a token-stream ORACLE any output whose tokens differ from the input, so it cannot change a program by construction. Style MEASURED from the whole corpus (18,561 files, 2.97M lines): 4-space indent, brace on the opening line, comma/semicolon/binary-operator spacing, struct field type columns aligned (1,340 of 1,712 multi-field runs), const and static single-space. Idempotent and build-neutral (formatted source compiles to byte-identical asm) proven over the tree; nx_srcfmt_gate 13/13 GREEN live, bite-proven both directions. Bars gofmt zig-fmt elm-format. WATCHING srcfmt_emit. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons behind Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	◉	●
Incremental compilation / build cache Measured: `inc_cache_lookup` exists in `runtime/nx_inc_compile.nx`, verified at emit. SHIPPED 2026-08-25 (nx_inc_compile LIVE 97,470 B, registered and authorised, but MEASURED INVOKED=NO by nx_catalog on 2026-09-06 so it reads REGISTERED-DARK; this note previously asserted an invocation no instrument can see, and the honest bound is that actlog watches the MCP surface only, so a direct fork would log the runner rather than this organ). Per-module cache keyed by the closure sha the build door ALREADY computes: it NEVER computes one of its own, it replays nx_closurehash's key and stores that ruler's per-file rows as the per-module table, so there is one key authority and not two. Proven by identity rather than assertion -- three recorded keys are byte-equal to /api/build's own closure_sha256 for the same targets, and gate tooth T8 re-forks the ruler and compares. The name-to-path resolver was EXTRACTED to nx_incclosure_lib and nx_closurehash now DELEGATES to it, so the cache cannot resolve a module differently from the ruler that hashed it (behaveprobe live-vs-staged IDENTICAL three times including the 78-file nx_mgmt_api closure). The member list is a deliberate SUPERSET of the ruler's closure -- it adds the crash guard and the compiler and assembler bytes, the inputs the ruler cannot see -- so it errs toward an EXTRA REBUILD and never toward a false hit. MEASURED ON THE REAL CORPUS, not a fixture: 6 targets over 18 modules and 47 member edges decided in 5 ms with ZERO forks and ZERO writes, against 9,274 ms to record five of them cold, about 4,600x on the decision; 47 member lookups served by 18 file reads (617 permil memoised); a warm 3-target build forks the builder ZERO times against 142 to 152 ms per fork when the incumbent cache serves the artifact and 773 ms for a genuine compile. Index is 2,548 B for 6 targets, bounded by a conf row with announced oldest-first eviction and a doubling growth window rather than a ceiling. PROOF: nx_inc_compile_gate 40/40 GREEN via /api/gate_run exit 0 on an isolated fixture tree with the incumbent cache DISABLED so it cannot serve the hit this rung is credited with -- byte-identity against a full build, a one-file edit rebuilding only its NAMED dependents while the non-dependent is provably never compiled, sibling invalidation (the subtlest false-hit class), corrupt-index refused whole, a toolchain axis where a compiler-byte change misses on unchanged sources, and four neg-controls; bite valid_mutants=1 killed=1 not_reached=0 with the restore byte-identical. TWO REAL DEFECTS FOUND BY RUNNING IT AND FIXED: a relative builder path could not survive the chdir and died execve 127, which read as the builder being missing and named the wrong subject; and the index fsync cost 27,107 ms of a 27,111 ms warm run on a loaded array, so the cache cost more than the builds it saved -- removed as a declared conf row with the arithmetic beside it, since the rename is atomic regardless and the loader refuses a corrupt index whole, taking the warm run to 64 ms. Every peer caches compilation and the anti-bar is the measured Rust adoption tax, so the decision path is fork-free by construction. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Debug info (DWARF .debug_line, statement granularity) Measured: `lm_stmt_stamp` exists in `runtime/nx_linemap.nx`, verified at emit. STALE-ABSENT CORRECTED 2026-08-14; shipped 2026-08-07. The note this replaced said emitted ELFs carry no source-line mapping. Opt-in via -g: lm_stmt_stamp records (address, file, line) OUT OF BAND keyed by instruction pointer (struct Instr was not widened), nxasm encodes the line program, and GNU readelf resolves the same addresses so third-party gdb and addr2line interop is real rather than asserted. MEASURED AT CORPUS SCALE, not on a fixture: 11,121 of 11,379 files built, 1,725,477 functions, 18,835,389 rows, ZERO per-file regressions. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=8 nonval=8` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	◐
Stepping debugger and .debug_info (types, variables, breakpoints) Measured: `dbg_step_over` exists in `runtime/nx_dbg_step.nx`, verified at emit. STATEMENT STEPPING SHIPPED 2026-08-25, gate-proven on the LIVE binary: nx_dbg_step_gate 29 of 29 GREEN via /api/gate_run exit 0 (re-run independently), mutation bite valid_mutants=1 killed=1 not_reached=0, restore byte-verified. Built ON LB5's line table, not a second one: it composes nx_addr2line_lib's DWARF v5 primitives and adds the two directions a debugger needs that nx_a2l_run structurally cannot give -- file:line to ADDRESS for breakpoints, and the whole row table across ALL sequences, where the incumbent keeps one row and stops at the first end_sequence. It also decodes special opcodes, const_add_pc, fixed_advance_pc and any standard opcode via the header's own standard_opcode_lengths, so the table reads third-party DWARF v5 and not only our emitter's subset; an incompletely decoded table answers UNPROVEN, never no-such-line. Proven on a runtime-assembled RV64 fixture carrying a real linking JAL, over a .debug_line emitted by our own nx_dwarf_line: breakpoint by FILE and LINE resolved to 0x80000008 and HIT, step INTO reported callee line 100, step OVER reported caller line 13 at 0x8000000c with depth back to 0 and NEVER the callee line -- the one behaviour separating a statement stepper from an instruction stepper, asserted from the same starting pc. Call depth follows the RISC-V spec's own return-address-stack hint rules, x5 alternate link register and RVC C.JALR and C.JR included, not a rd-equals-ra guess. NEVER-BRICK IS STRUCTURAL, NOT PROMISED: func sys_ptrace is ABSENT-PROVEN estate-wide (matches=0 coverage_complete=1 corpus_complete=1) so no host process is reachable, the grammar has no pid and a pid-shaped argument is refused bite-proven, breakpoints are a bitmap so guest code is never patched and code_bytes_unchanged=1 is MEASURED every run, and detach is an in-process resume that runs even when the script never asks (auto=1, guest exit 5 matching the debugger-free reference sim). SCOPE, because this row was split in 2026-08-14 precisely so it would name its failing conjunct: the STEPPING half is LANDED; the .debug_info half is FUNCTION NAMES ONLY (DW_TAG_subprogram, wired for frame naming) and TYPES and VARIABLES remain ABSENT -- the shipped decoder understands only DW_FORM_addr and DW_FORM_string and refuses every other form, so DW_TAG_variable and DW_AT_location are unreachable today; the EMIT side was not measured and is not claimed either way. Backtrace is 2 frames (pc plus link register) and prints deeper_frames=UNWALKED rather than inventing callers. Execution surface is the sovereign RV64 interpreter: nxasm_rv64 is ABSENT-PROVEN so there is no RV64 compiler backend, and our .debug_line is emitted by the x86-64 assembler, so stepping a NATIVELY-executing nx_cc binary still needs an x86 interpreter or ptrace, and ptrace is refused on never-brick grounds rather than taken silently. gdb-on-C stays the bar. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_dbg_step_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Free multi-line expressions Measured: `tok_line_continuation` exists in `runtime/nx_lex_kinds.nx`, verified at emit. SHIPPED 2026-08-25 and LIVE ON THE TOOLCHAIN (buildroot/_offc/nx_cc_sovereign.elf 738,558 B, promote canary GREEN). A continuation line opening with a binary operator now JOINS the expression above it. ORGAN PATH RE-KEYED to nx_lex_kinds.nx, where tok_line_continuation is DECLARED: that file already declares itself the shared home for exactly this (lex.nx and parse.nx used to carry local copies of the Tok layout and now share one), so the predicate costs no new import edge and there is only ever ONE of it. at_stmt_boundary already relaxed fifteen always-binary kinds in 2026-05-16; the residual was the four it called ambiguous. Three of them are not: NishiLang has exactly ONE operator-led statement form (parse_stmt_star, the pointer store), so no statement begins with plus, minus or ampersand and at statement level they can only ever have been a continuation. TK_STAR is the one true ambiguity and is decided by sb_star_starts_store, which looks for the store's assign at bracket depth 0 BOUNDED BY THE PHYSICAL LINE rather than by a chosen constant. THE SAFETY ARGUMENT IS CHECKABLE, NOT ASSERTED: the programs this reclassifies are exactly the programs that DO NOT BUILD TODAY, because the 2026-08-13 discarded-pure-expression refusal already rejects them -- so joining them cannot change the meaning of any program that compiles. Proven by the baseline half of the bite: the pre-LN15 compiler fails all four join cases with build=1, i.e. by REFUSING them. PROOF: nx_linecont_gate 10/10 GREEN on the promoted toolchain and 5/10 RED on the banked pre-LN15 compiler, the same gate binary against two real compilers rather than a synthesised mutant, with only the four capability teeth moving; nx_cc_equiv_gate rows=10 passed=10 selfhost=1 tree_moved_rows=0 GREEN with every row byte-identical (ea equals eb) and the self-host fixpoint at 738,558; nx_contentdiff GREEN 0 lost runs against BOTH live artifacts; nx_stale_check rebuild reproduces the staged bytes exactly with capability_check=OK. The gate carries a POSITIVE CONTROL and earned it: its first run was RED with even an ordinary one-line program failing exit 127, which was NAS /tmp being noexec and not a language fault -- four of its teeth are satisfied by a refusal, so without a tooth that must simply work an environment fault would have been published as a verdict about the language. Same edit removed twenty-odd bare token NUMBERS from at_stmt_boundary (if k == 56 beside TK_PIPE in the lexer is one constant written twice) and, separately, two stray sys_write(2) calls in parse_function that emitted the function name for EVERY function of EVERY compile with no newline, gluing the first real diagnostic of every build onto the last function name: measured at 62 to 82 percent of compiler stderr across the equivalence corpus. Every peer parses free layout; the det2x2 defect of 2026-07-09 was this class before the refusal existed. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=74 nonval=71` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Working floating point (f64) Measured: `x86ctx_emit_f64` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. SHIPPED 2026-08-25 and LIVE ON THE TOOLCHAIN (buildroot/_offc/nx_cc_sovereign.elf 778,655 B, promote canary GREEN). The board's own done-rule now passes: runtime/nx_probe_float.nx compiles and exits ZERO, where it exited 1 on 2026-07-09. SYMBOL RE-KEYED, and deliberately NOT by renaming code: the watch named x86_emit_f64_binop, which is ABSENT-PROVEN across the corpus at corpus_complete 1 -- no such function was ever written. Creating one to light the cell would be the stub-carrying-the-contract-name defect this board warns about, so the row now names the function that HONESTLY declares the capability, x86ctx_emit_f64 at nx_x86_64_ctx.nx line 2472, with x86ctx_emit_f64_ordkey beside it for ordering. PROOF: nx_f64_gate 25 of 25 GREEN on the promoted toolchain, and its expectations are DERIVED from an independent software IEEE-754 oracle (nx_f64_oracle_sov, anchored on 1217 hardware KATs) rather than hand-typed -- add sub mul div agree BIT FOR BIT, exactly on representable results and under round-to-nearest-even where they are not: 2^53+1 rounds back to 2^53, 2^54-1 needs 54 significand bits, the square of 2^27+1 needs 55, and 1.0/3.0 fills all 52 stored bits. Ordering was wrong for NEGATIVE doubles and is now right: a signed-integer compare of the bit patterns says -1.0 is less than -2.0 and IEEE says it is not, and the gate carries that exact pair as a neg-control so the tooth sits precisely where integer compare fails. THE SHARED-BACKEND RISK IS MEASURED, NOT ARGUED: f64 rides the same emitter integer code uses, so the gate compiles one integer source with the subject and with a REFERENCE compiler and byte-compares the emitted assembly -- 30,546 bytes both, identical 1. Without that reference the axis reported UNOBSERVABLE and the whole gate returned SKIP rather than a pass it had not earned; supplying the reference is what turned it GREEN. The incumbent nx_f64_adversary could not have caught any of this: it is a DECIMAL instrument with six hand-typed truncated constants, all non-negative, so it cannot see a one-ulp error and cannot see an inverted negative compare, which is why it ran green over this defect since 2026-07-16. This is a CORRECTNESS fix so the language is not silently wrong when someone writes f64; it does NOT make float a recommended path and does not weaken the integer-deterministic no-float doctrine, which remains this board's exceed. NaN unorderedness is a declared residual. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Bounds-checked TYPED array access, [N]T and []T (CWE-787 and CWE-125 class) Measured: `NX_BOUNDS_CHECK_LIVE` exists in `runtime/nx_parse.nx`, verified at emit. SPLIT OUT AND CORRECTED 2026-08-14. The single row this replaced said flatly that out-of-bounds is unprevented, which merged a SHIPPED half with an ABSENT half. Typed array access IS checked and the checks are LIVE, not compiled out: NX_BOUNDS_CHECK_LIVE (nx_parse.nx:1352) is the kill switch and emit_bounds_check injects against it, trapping NX_TRAP_BOUNDS. The cost is MEASURED, not modelled -- nx_bounds_perf.nx runs the same loop both ways and the check costs 2.23x on a bounds-checked accumulate loop (checked 10,237us vs unchecked 4,581us). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	●	●
Raw-pointer access prevented (CWE-787 and CWE-125, the unchecked half) Measured: `bck_ptr_provenance` exists in `runtime/nx_boundscheck.nx`, verified at emit. SHIPPED 2026-08-19 as the --ptrprov DECLARED MODE: a let-bound sys_mmap(const) pointer is bounds-checked like a typed array on read AND write legs, and a provably-out-of-range constant index is refused at compile time. Proof: nx_boundscheck_gate 11/11 GREEN on the shipped toolchain and 7/11 RED on the pre-LN3 baseline (bite-proven both directions); nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary 8/8. Default stays OFF (corpus byte-identical by construction) until the per-class ratchet flips it after a clean corpus census; runtime-sized allocations and var pointers are the named residual. The 2026-07-08 READ-TO-NUL over-read was this class in the wild and is the gate's fixture. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	◐	●	●
Use-after-free prevented (CWE-416 class) Measured: `own_check_uaf` exists in `runtime/nx_ownership.nx`, verified at emit. own_check_uaf SHIPPED 2026-08-25 in the SAME checker as LN4 and LIVE on the toolchain: after sys_munmap(p, n) any read of p is a compile error naming the local and the release line, stamped capability=own-check-uaf. A DOUBLE FREE falls out of that ONE rule rather than needing a second, because the second release must READ the name in order to pass it -- so CWE-415 is covered by construction and its refusal correctly stamps own-check-uaf and not a separate rule. THE WATCH STAYS OPEN DELIBERATELY: default OFF until the per-class ratchet flips it, same as LN1 LN2 LN3 and LN4. THIS ROW'S OWN PREMISE WAS MEASURED AND IS FALSE AS IT WAS WRITTEN. The arena no-free doctrine does not hold because nothing frees: sys_munmap has ONE definition and 1,431 REFERENCE SITES at corpus_complete 1, while nxa_reset and nxa_free are ABSENT-PROVEN. What makes the doctrine FEEL true is sys_munmap's own body, which returns early when len is at or below NXA_SMALL_MAX, currently 256 -- so a small release is an arena no-op today and a use-after-free is invisible at runtime. The checker refuses BOTH sizes deliberately rather than keying a memory-safety rule on an allocator constant, because that constant has already moved once (256 to 128) and keying on it would silently un-refuse a whole class the day it moves again. PROOF: 19 of 19 GREEN on the promoted toolchain against 2 of 19 on the pre-rung builder, including an ALIAS fixture where the freed buffer is read through a SECOND name -- a checker that marked only the name inside the sys_munmap call would report nothing at all there -- and a double-free fixture that compiles and runs exit 0 under the default today. Rust borrow checker is the bar. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Rust (leads), Go (leads), Elm (leads)	●	◉	●	◉	◉
Integer overflow checked (CWE-190 class) Measured: `chk_add_overflow` exists in `runtime/nx_checked_arith.nx`, verified at emit. STALE CLAIM CORRECTED 2026-08-14: this note used to say an immediate shift over 31 blanks the emitted .s (2026-07-06). That was measured FALSE -- it compiles and returns the MASKED value, which is worse, because a silent wrong answer beats a visibly empty one at hiding. FIRST RUNG SHIPPED 2026-08-13 and gated (nx_probe_ub_shift.nx, nx_langdiag_gate row): a CONSTANT shift count outside the result width is now REFUSED at compile time naming the legal range and stamping capability=shift-count-range. SHIPPED 2026-08-23 as the --chkarith DECLARED MODE (the LN3 shape): every i64 + - * is followed by an overflow check that traps exit 72 (NX_TRAP_OVERFLOW) instead of wrapping; a constant overflow in source is REFUSED at parse time naming the rule; __wrap_add/__wrap_sub/__wrap_mul are the exempt wrap-by-intent forms (the Zig +% / Rust wrapping_* contract), so hashes keep building once the mode flips. Proof: nx_chkarith_gate 17/17 GREEN on the promoted toolchain and 9/17 RED against the banked pre-LN1 compiler (exactly the eight mode teeth fail -- bite-proven both directions on the NAS and the laptop); nx_cc_equiv_gate 10/10 plus selfhost GREEN; promote_toolchain canary GREEN; default builds byte-identical by construction (full-population local A/B sweep over every top-level program, not a sample). Default stays OFF until the per-class ratchet flips it after a clean corpus census -- the residual is the i32 lane (declared mod-2^32 semantics) and runtime shift counts. WATCHING chk_add_overflow. Zig safe-mode and Swift trap-by-default lead; Go wraps by definition. [regehr-ub] Adoption: `FIXTURE` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Go, Elm; fully adopted on the estate ladderCons behind Zig (leads)	●	◐	◉	○	◐
Null and sentinel-zero deref prevented (CWE-476 class) Measured: `opt_enforce_unwrap` exists in `runtime/nx_option_enforce.nx`, verified at emit. Sentinel-zero-as-null is our recurring P2 meta-class; Option and Result EXIST in the stdlib but nothing enforces their use, so they are a convention wearing the shape of a type system. Elm ships no null at all. SHIPPED 2026-08-23 as the --optenforce DECLARED MODE (the LN3/LN1 shape): a dereference of a pointer-typed LOCAL not proven non-null on its path is REFUSED at parse time naming the local and the fix (capability=option-enforce-unwrap). Proof comes from the idioms this corpus already writes -- `if p != 0 {` (then-block), the early-exit `if p == 0 { return/break/continue/sys_exit }` (rest of the block), `if p == 0 {} else {` (else-block), `while p != 0 {` (body), nx_assert_ptr(p ...) -- and a reassignment re-derives the bit from the new value, so a stale check does not survive `p = call()`. DECLARED FLOORS, each one measured against the stdlib rather than chosen: parameters are trusted (the callee's contract; no nullable annotation exists yet), module statics are trusted (initialisation order is not modelled), sys_mmap results are non-null by the allocator's own contract (nxa_die on failure), integer-to-pointer casts and computed addresses are trusted, and chained derefs through loaded fields or call results (`a.b.c`, `f().x`) are not named locals and are not checked -- bind them to a local first, the estate's idiom. Proof: nx_optenforce_gate 14/14 GREEN (hazard nx_option_enforce.nx refused at `p.val`, the reassign witness refused after `p = call()`, the positive control nx_option_enforce_ok.nx with all nine idioms compiles AND runs under the mode, the mode emits no IR so the control's asm is byte-identical default vs mode) and 9/14 RED against the pre-LN2 compiler (exactly the five mode teeth); nx_cc_equiv_gate 10/10 plus selfhost GREEN; default builds byte-identical (nothing emits unless the flag is on). Default stays OFF until the per-class ratchet flips it after a clean corpus census. WATCHING opt_enforce_unwrap. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `FIXTURE` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads), Elm (leads)	●	◉	◉	◐	◉
Data-race prevention (CWE-362 class) Measured: `sync_send_check` exists in `runtime/nx_parse.nx`, verified at emit. Thread pool is real (7x measured) but there is no Send-Sync-class typing; Go ships a runtime race detector, Rust and Swift 6 enforce at compile time. WATCHING sync_send_check. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go; fully adopted on the estate ladderCons behind Rust (leads)	●	◉	○	◐	●
Living bug-class ledger wired to language evolution Measured: `Bug Taxonomy` exists in `docs/BUG_TAXONOMY.md`, verified at emit. F1-F16 taxonomy + P1-P10 meta-patterns + the nx_cc trap register drive make-it-unrepresentable rungs; peers have public bug trackers (the dumps we bank) but not a ledger wired to language change rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. not adopted: no source and no binary: this is a build contract, not a partial deploy Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: no source and no binary: this is a build contract, not a partial deploy	●	◐	◐	◐	◐
Sovereign whole-stack toolchain (language compiler assembler runtime -- zero LLVM GCC libc beneath) Source present; authored stronger claim: `func main(argc` in `runtime/nx_compile_x86.nx`, verified at emit. The entire chain nx_cc to nxasm_x86 to ELF is ours bits-up and compiles on the NAS over the mgmt API (build-over-API GREEN 2026-07-06); Rust and Zig sit on LLVM; Go owns its backend but links foreign substrate below rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	◐	○
Integer-deterministic no-float doctrine (cross-platform bit-exact by construction) Source present; authored stronger claim: `qmul` in `runtime/nx_nofloat_llm.nx`, verified at emit. A 100 percent integer LLM greedy-matches the float reference 4-for-4 (ledger AHEAD, 2026-07-09); gate-grounded across the codec and compute censuses; no peer ships float-free determinism as language doctrine Adoption: `LIB-WIRED importers=34 nonval=8` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Errors as values with enforced propagation (the Midori model) DARK — `runtime/nx_parse.nx` EXISTS but does not declare `res_propagate_op`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ADMITTED 2026-08-19 from the 4-lane research sweep. Option and Result exist in the stdlib unenforced -- a convention wearing the shape of a type system. The Midori split is the bar: typed recoverable errors in signatures plus fail-fast abandonment, with one-character propagation so checking never rots into boilerplate [midori-errors]. Go proved in 2025 that this cannot be retrofitted once a community standardizes on the boilerplate [go-errsyntax]. WATCHING res_propagate_op: a dropped Result refuses (must-use) and a propagation form rethrows with context. watching res_propagate_op Pros none measured yetCons behind Rust (leads), Zig (leads), Go, Elm (leads); open contract, nothing on disk yet	○	◉	◉	◐	◉
Structured concurrency (scoped spawn, no orphan tasks) Measured: `sc_scope_spawn` exists in `runtime/nx_thread_pool.nx`, verified at emit. LANDED 2026-08-25 against the research floor of spawning only inside a scope that joins its children [njs-nursery]. Within the scoped API the orphan shape is UNREPRESENTABLE: join is the only exit, sc_scope_free REFUSES an unjoined scope, spawn into a joined one refuses by name, double-join refuses -- there is no verb sequence that ends a scope without joining it. A child error propagates to the scope, NAMES WHICH CHILD, and cancels that scope; cancellation is scoped by construction because the flag lives in the scope header. COLORLESSNESS PRESERVED, the trap named by the colored-function essay still not taken [nystrom-colors]: a child is a plain func of i64 to i64 and all 48 nx_pool_submit call sites are byte-for-byte unchanged (full-population census, 23,257 files, coverage_complete=1, partition 35 production plus 11 gate plus 1 definition plus 1 comment reconciling to 48). BEYOND RUST SCOPED THREADS AND GO ERRGROUP, WHICH ARE LIBRARIES SITTING BESIDE A BARE SPAWN: sc_strict_set(1) makes the BARE nx_pool_submit refuse SC_REFUSE_UNSCOPED, asserted on pool STATE (tasks_submitted unchanged 52 to 52) and not on the message, so the only route into the pool becomes a scope that joins it. It SHIPS OFF because 35 production call sites still use bare submit, so the honest word is ENFORCEABLE NOT YET ENFORCED, and it is NOT the compile-time law: NishiLang has no lifetimes or regions and the compiler was not touched, so Rust remains stronger on that axis. PROOF: nx_sc_scope_gate 35/35 GREEN via /api/gate_run exit 0 twice independently; pool witness nx_pool_ring_gate 6/6 GREEN over 70,000 tasks with the shared counter exactly right and all workers exited; bite valid_mutants=1 killed=1 not_reached=0 with the pool source restored byte-identical, honestly declared as a mutation floor of one and killed by TIMEOUT rather than by an emitted RED. SPEEDUP RE-MEASURED RATHER THAN CITED, AND THE OLD FIGURE IS CORRECTED: 3.0 to 3.9x on 8 cpus at load 9.7 to 14.1 across three runs, with the scoped form never slower than bare; the July 7x was a quiet box and is not reproducible under real load, so the floor was ratcheted to 3000 permil guarded by an IN-RUN control requiring the incumbent bare arm to clear the same floor, because a load-based bar on a host that sits at 14 to 21 would be permanently SKIP, the detector nobody reads. ENVELOPE MEASURED: 41,056 B per scope in ONE mmap and one VMA, 40 B per spawn inside that existing mapping with zero extra syscalls, join allocates nothing, and live bytes go 0 to 41,056 to 0 after join and free. Join bounds are DERIVED from nx_pool_wait because a scope child IS a pool task, with the conf deliberately carrying NO row and two teeth checking that linkage mechanically so it cannot be silently unpinned. Zig dropped async pending redesign; Elm has no threads. Adoption: `LIB-WIRED importers=46 nonval=27` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	○	◐	○
Supply chain by construction (no install scripts, content-addressed, no registry attack surface) Measured: `pkg_cas_resolve` exists in `runtime/_hdl_build/nx_pkg.nx`, verified at emit. LANDED 2026-08-25. The 2025 registry worms exploited install-time code execution and blind version trust [tob-supply2025]; this lane removes both. pkg_cas_resolve is live in nx_pkg (63,205 B promoted, registered, invoked) and gate-proven by nx_pkg_gate 19 of 19 GREEN via /api/gate_run exit 0. ORGAN PATH RE-KEYED to _hdl_build, where nx_pkg is DECLARED: runtime/nx_pkg.nx never existed, so the old path could never have measured anything, and nx_pkg already carried a byte-sum demo that was EXTENDED rather than duplicated (nx_presubmit BLOCKED the dual copy). A module resolves by sha256 digest -- the same digest nx_filehash and nx_closurehash use, agreement proven twice -- with no name lookup at the digest layer, so there is no version negotiation and no latest to poison. The store path is a hint and the hash is the identity: bytes substituted at the legitimate digest path refuse digest-mismatch, bite-proven against a restore that resolves. A lookalike name refuses name-not-pinned at exit 9 and writes no file, while the legitimately pinned name resolves at exit 0 as the positive control -- a guard that refused everything would fail there. Zero install-time execution is proven mechanically, not asserted: a module carrying a working install hook RESOLVES SUCCESSFULLY and the hook side effect is ABSENT, the hook having first been shown to fire when executed; static corroboration ABSENT-PROVEN for sys_execve, sys_fork and sys_clone at corpus_complete 1. Two mutants were killed, one disabling the re-hash and one disabling the unpinned refusal, the second earning its keep by proving the suite asserts WHICH rule fired -- the typosquat was still refused, for the wrong reason. Transparency is a hash-chained journal that refuses to extend a broken chain: tamper-evident against a partial edit but NOT sumdb equivalent -- one writer, unsigned, unwitnessed, no inclusion proofs -- which is why exceed stays 0 rather than claiming a clean win. Residual named in source: pin time is the trust boundary, a whole-journal rewrite verifies, no signature layer is wired, and the compiler import path still resolves by filesystem name. Adoption: `RUN-BY:fork:nx_pkg_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Elm; fully adopted on the estate ladderCons behind Go (leads)	●	◐	◐	◉	◐
Language-level capability security (no ambient authority) Open — watching `runtime/nx_caplang.nx` : `cap_root_main`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. ADMITTED 2026-08-19. No mainstream language ships it -- any transitively imported function can open any file or socket, which is the root of supply-chain risk. Austral and Pony prove the design: authority is a value handed to main, and a dependency signature IS its permission manifest [austral-caps]. The estate ops surface is already ocap (attenuate-only, live-proven); this watch extends it into the type system. Honest greenfield: nx_caplang.nx does not exist. WATCHING cap_root_main. watching cap_root_main Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Written language specification + conformance suite Measured: `spec_conformance_run` exists in `runtime/nx_langspec.nx`, verified at emit. SHIPPED 2026-08-25, taking the Ferrocene lesson early rather than retrofitting a spec years after 1.0 [ferrocene]. nx_langspec LIVE 51,172 B registered and invoked; nx_langspec_gate 30 of 30 GREEN via /api/gate_run exit 0 (re-run independently), mutation-bitten valid_mutants=1 not_reached=0 killed=1 with the twin restored byte-identical. The specification is DATA (33 clauses in knowledge/specs/nishilang.spec) and so is the suite (35 cases), so every case cites the clause IDs it exercises and traceability is resolved MECHANICALLY rather than asserted -- which is the thing a hand-coded row list structurally cannot have. Full production run over the SHIPPED compiler: 35 pass, 0 fail, 0 unobservable, both partitions reconciling, 33 of 33 clauses exercised at 1000 permil against a declared ratchet raised 800 to 1000 after the gain, unresolved citations 0. Three states never two: a case the runner cannot judge is UNOBSERVABLE and folds into neither pass nor fail. The load-bearing tooth is the planted deviation and it is proven in BOTH directions: a clause and the compiler made to disagree exits DEVIATION naming the case and the reason; a refusal for the WRONG reason is also a DEVIATION, so a suite that only asks whether the program was refused cannot pass here; an empty suite exits EMPTY and can never be success, the vacuous-test defect wearing a certification costume; and an ABSENT compiler ABSTAINS at exit 3, which is what proves the runner really forks the shipped compiler instead of simulating it. It composes nx_ccgate_lib rather than adding a second compiler driver, extending it additively with a compile-only verb because the incumbent collapsed every failure to 1 and made the refusal-exit clause untestable. FIRST RUN FOUND A REAL GAP AND THE SPEC REFUSES TO LAUNDER IT: the integer-literal-range rule is written in nx_parse.nx and ABSENT-PROVEN from the shipped toolchain binary (positive control: the sibling shift-count-range capability IS present in the same binary, so the scanner reads binary content), so three out-of-range literals are accepted today. Filed as debt 1787687118 and deliberately NOT specified until it ships -- specifying the defect as intended would launder it, and a permanent RED is a detector everyone learns to ignore. Go's spec remains the field's best; Zig has none. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, ElmCons behind Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◐	○	◉	○
Safety ring inherited by NishiOS + Nishi Browser (the Rule-of-2 discharge) Source present; authored stronger claim: `oa_state_name` in `runtime/nx_osattest.nx`, verified at emit. SHIPPED 2026-08-25. Chromium forbids combining untrustworthy input, an unsafe language and high privilege, and the incumbents discharge it by SANDBOXING AROUND their language [rule-of-2]; a kernel-up single-language stack discharges the unsafe-language leg everywhere. nx_osattest is LIVE at 68,288 B, registered and invoked, with nx_osattest_gate 24 of 24 GREEN via /api/gate_run exit 0 (re-run independently after the lane that built it was killed mid-flight -- an organ found promoted is run, never trusted). SYMBOL RE-KEYED HONESTLY: the watch named nxos_lang_ring_attest, which is ABSENT-PROVEN across the corpus at corpus_complete 1 -- no function of that name was ever written, the capability lives in the organ itself. Renaming code to match the contract would be the stub-carrying-the-contract-name defect, so the row now names oa_state_name, which is distinctive to this organ and whose existence IS the capability: it declares the six attestation states. THE ORGAN REFUSES A SILENT DEFAULT COMPILER BY DESIGN -- with no argument it exits usage rather than attesting, because a default produces a fully-formed verdict about whatever binary happened to be lying there. The gate is built out of the states rather than a score: the partition SUMS to its declared population, a planted source that must be refused is counted refused AND the refusal NAMES the declared rule rather than merely being a refusal, and a clean source is still counted ATTESTED as the positive control, which is what stops an attester that refuses everything scoring perfectly. UNOBSERVABLE IS A REAL THIRD STATE AND IS PROVEN THREE WAYS: a real-looking flag the compiler silently ignores is reported UNOBSERVABLE with that exact reason and is counted neither clean nor refused nor quietly dropped, and a rung with no compiler flag at all reports flag-undeclared, a DIFFERENT reason. The denominator travels with the score and the missing modes are NAMED. An absent subject exits UNPROVEN into its own bucket and the canonical last line reads RED, because a confident attestation over a subject that is not there is the worst outcome available to this organ. An empty population is REFUSED, never reported as a clean sweep. Rust holds Part via Rust-for-Linux and Servo. Adoption: `RUN-BY:fork:nx_osattest_gate` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	○	○	○
Sound bounds-check elision (checked speed at unchecked cost) Measured: `bck_elide_dominated` exists in `runtime/nx_bck_elide.nx`, verified at emit. ADMITTED 2026-08-19. The bounds check costs a measured 2.23x on the accumulate loop (checked 10237 us vs unchecked 4581 us) while peers elide dominated re-checks in their optimizers. An UNSOUND elision is a silent memory-safety hole, so every elision must ride the blessed dominance oracle and the elision proof gate is the tooth. WATCHING bck_elide_dominated. MEASURED 2026-08-31 and the contract is DELIBERATELY HELD OPEN because the pass is WRITTEN and GATE-PROVEN but NOT IN THE SHIPPED COMPILER. Field 2 of this row is a KNOWN-WRONG POINTER kept on purpose: bck_elide_dominated is declared at runtime/nx_bck_elide.nx:444 and called at runtime/nx_opt.nx:2627 inside opt_bounds_check_elim, which the opt round calls at nx_opt.nx:3957 behind the --bckelide declared mode, and nx_opt.nx:28 imports the file so it IS in the compiler build closure; runtime/nx_boundscheck.nx carries only a comment plus the DISTINCT symbol bck_elide_dominated_witness (nx_absent over buildroot/runtime, 8 matches, coverage_complete=1 corpus_complete=1). ONE gate, two compilers, same box same minute: nx_bck_elide_gate against the LIVE promoted nx_compile_x86.elf (737605 B) is 10 of 13 RED with the dominated assembly BYTE-IDENTICAL under the flag (32063 vs 32063, so the flag is inert), and against the unpromoted buildroot/_build/nx_compile_x86.sov.elf (778679 B) is 13 of 13 GREEN with the dominated assembly falling 32063 to 31411, the non-dominated case still byte-identical and both out-of-bounds legs still trapping 71. So the live toolchain provably lacks LN7 elision and the single outstanding action is a toolchain promote of nx_compile_x86 -- written, compiled, not promoted. DO NOT repoint field 2 at runtime/nx_bck_elide.nx on its own: wp_classify in nx_swcompare_lib returns ONLY LANDED or WATCHING for an _ABSENT_ row, so repointing alone would flip this cell LANDED over a capability the shipped compiler does not have. Repoint it in the SAME change that lands the promote. LN7 is PARTLY shipped: nx_x86_regalloc_use_gate is 5 of 5 GREEN on the live compiler, so the backend regalloc half is in and only the elision half is missing. RE-DERIVED 2026-09-03 AND THE PARAGRAPH ABOVE IS NOW STALE IN THE PESSIMISTIC DIRECTION: the toolchain promote it names as the single outstanding action HAS ALREADY LANDED (live nx_compile_x86.elf is 923280 B, not the 737605 B measured on 08-31), and nx_bck_elide_gate run against THAT LIVE PROMOTED COMPILER is 13/13 GREEN -- elision proven dominance-gated, both out-of-bounds legs still trapping 71, the non-vacuity tooth confirming both legs already trap WITHOUT the flag, and the elided program still computing the closed form both under and without the flag. MEASURED BY THE GATE, NOT ASSERTED BY HAND: h2h_A2_divfree_checked_no_elision_us=41266 against with_elision_us=20711, a 1.99x win on the div-free checked accumulate loop. Field 2 is REPOINTED at runtime/nx_bck_elide.nx in this same change, exactly as the paragraph above instructs, because the capability is now IN THE SHIPPED COMPILER and the cell may flip honestly. ONE REGRESSION IS OPEN AND DELIBERATELY NOT HIDDEN: on the modulo arm the same gate reads h2h_A_modulo_checked_no_elision_us=102547 against with_elision_us=112529, so elision COSTS about 9.7 percent on that shape; the gate publishes that ratio and gates nothing, so no instrument in the estate would have caught it. LESSON: a matrix note that hand-asserts what the SHIPPED BINARY can do rots silently and in the flattering-to-nobody direction -- two rungs on this board (LR7 and LN18) were both understated today, and each cost a full investigation to re-derive. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads), Go (leads)	●	◉	◉	◉	○
Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop) Measured: `bck_elide_induction` exists in `runtime/nx_bck_elide.nx`, verified at emit. LN7b SHIPPED TO SOURCE 2026-09-01, gate nx_bck_iv_gate 20/20 GREEN on the candidate compiler (F1 both loop checks elided and the program still computes its closed form 88; F2 a guard wider than the array KEPT and trapping 71; F3 a non-constant step KEPT; F4 a reset on the guard-to-access path KEPT and trapping; F5 a counter whose address escapes KEPT and trapping; --mode=f1 byte-identical to --bckelide; an undeclared mode REFUSES). The proof is the one the dominance pass (LR7) structurally cannot see: the loop-header compare LT_S(LOAD(k), L) with L not above the array length, k a non-escaping local whose every store is a constant reset or a guarded constant-step increment, and no store to k on any guard-to-access path. Lower bound follows from a zero or positive reset and non-negative steps that cannot wrap before the guard fails. MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. Peers: LLVM elides these via SCEV range analysis and IRCE loop splitting [llvm-irce], Go via its prove pass carrying Limit{Min,Max,Umin,Umax} lattices per value [go-prove]; Zig rides LLVM in its release modes. Elm has no bounds-checked array indexing to elide. Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons behind Rust (leads), Go (leads)	●	◉	●	◉	○
Compiler modes as declared data (daily, f1, drag, checked, small) Measured: `nxcx_expand_mode` exists in `runtime/nx_compile_x86.nx`, verified at emit. SHIPPED TO SOURCE 2026-09-01. A mode is a NAMED BUNDLE of flags the driver already parses, declared in knowledge/lang_modes.conf (four pipe-separated fields: mode, name, flags, intent) and expanded before the ordinary argv loop, so a mode can never do anything a hand-typed flag list could not; an undeclared mode or a missing conf REFUSES the build with exit 9 naming the rule (a silent default is a mode wearing the wrong name). Operator framing 2026-09-01: real speed like an F1 car and a daily driver, not a drag race -- daily = every safety mode ON with proven elision and the line table; f1 = checks live with sound elision; drag = elision without the crash-guard closure; checked = every safety mode ON and nothing elided; small = no crash guard. Proven: --mode=f1 assembly byte-identical to --bckelide (gate tooth), and the receipt carries one arm per mode. Peers: Cargo profiles are user-declared data, Zig ships Debug, ReleaseSafe, ReleaseFast and ReleaseSmall built into the compiler, Go has no optimisation levels (Part), Elm has --optimize. No exceed claimed: declared modes are table stakes; the exceed is the receipt that measures every mode side by side. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	◐	●
Head-to-head receipt with one arm per compiler mode Measured: `h2_build_nx_mode` exists in `runtime/nx_lang_h2h.nx`, verified at emit. SHIPPED TO SOURCE 2026-09-01: nxmode_<name> rows in the bench conf become arms named nishilang-<name>, built through --mode=<name> so the receipt measures exactly the declared bundle and never a private copy of it. MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. The page renders the receipt (bench_pass) and nx_lang_h2h_gate proves it self-consistent. Peers publish compiler dashboards (rustc-perf, Go benchmarks) but no language publishes a cross-language receipt per mode on its own comparison page; scored 0 for all because none ships this artifact, and NO exceed is claimed until the receipt is produced by the PROMOTED toolchain on the estate host. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	○	○	○
Checked arithmetic at add-plus-jo cost (the daily mode as fast as the default) Measured: `x86ctx_ovf_fuse` exists in `runtime/nx_x86_64_ctx.nx`, verified at emit. LN18 SHIPPED TO SOURCE 2026-09-01 (x86ctx_ovf_fuse plus jo/jno in the sovereign assembler), gate nx_chkarith_jo_gate 15/15 GREEN on the candidate compiler: the checked loop carries jo/jno branches and adds ZERO xorq to the plain build (every checked add and sub site fused), MAX+1 still traps 72 where the plain build wraps to 91, MIN-1 still traps 72 where plain wraps to 159, __wrap_add stays exempt, and --mode=daily computes the same value -- with the bite proven (the trap fires on the overflowing add and stays silent on the in-range loop). MEASURED BEFORE on the receipt: the daily and checked modes cost 17,011 and 16,939 us against 7,145 us for the default build (2.4x) because LN1 lowers every checked add as backend-agnostic IR (xor, xor, and, compare-with-zero, branch) rendered as six instructions with stack spills per add. MEASURED AFTER, same receipt: daily 10,567 us and checked 10,688 us against 7,105 us default (1.49x). The fuse recognises the exact LN1 shape ((a xor r) and (b xor r)) less than zero with the four intermediates single-use by the emitter own G8 operand count and emits addq or subq then jo on the live flags; the predicate is identical, so it is equivalence-net work not a semantics change. THE DONE-RULE (within 1.3x of the default) IS NOT MET YET: the remaining 1.49x is register homing -- the allocator still sees the four skipped intermediates as uses and spills the accumulator around them, so the next step is to take the fuse decision before allocation. Peers: LLVM lowers llvm.sadd.with.overflow to add+jo for Rust debug builds and Zig ReleaseSafe; Go wraps silently by specification (no check to make cheap); Elm has no fixed-width integers. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, Elm; fully adopted on the estate ladderCons behind Rust (leads), Zig (leads)	●	◉	◉	○	○
Integer SIMD reduction vectorization (packed adds for the accumulate loop) DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_vec_reduce`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. THE WHOLE REMAINING GAP TO CLANG, MEASURED 2026-09-01: clang -O2 runs the same loop in 1,138 us on 14 AVX2 packed adds per iteration block and gcc -O2 in 2,082 us on a 6-instruction SSE paddq loop, while the f1-mode NishiLang loop is 7 scalar instructions (compare, jump, lea, load, add, increment, jump) with zero bounds-check work left to remove; the rest of the distance is vector width, not checks. Contract: a reduction-vectorization pass over the eqsat-normalised IR (LN8) for integer sums with a provable trip count, proven by the equivalence net. Research bar: the LLVM loop and SLP vectorizers [llvm-vectorizers]; the 2026 frontier attacks the conservative-analysis ceiling from the other side -- LLM-generated explicit SIMD that in some cases surpasses -O3 [arxiv-autoveccoder-2026], compiler-composed nanokernels competitive with hand-tuned microkernel libraries [arxiv-nanokernels-2025], and LLM-synthesised equality-saturation strategies that keep e-graphs tractable [arxiv-eggmind-2026] (listings mirrored as the dated index the survey was drawn from [arxiv-autovec-list-2026] [arxiv-eqsat-list-2026]). Peers: Rust and Zig inherit both LLVM vectorizers; Go does not auto-vectorize; Elm compiles to JS. watching opt_vec_reduce Pros none measured yetCons behind Rust (leads), Zig (leads); open contract, nothing on disk yet	○	◉	◉	○	○
Loop splitting for bounds the guard does not imply (IRCE) DARK — `runtime/nx_bck_elide.nx` EXISTS but does not declare `bck_irce_split`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ADMITTED 2026-09-01 as the next elision rung after LN7b. When the loop guard is WIDER than the array (the F2 fixture, `while k < 2048` over [1024]) the induction pass correctly keeps the check; LLVM instead splits the iteration space into pre-loop, main loop and post-loop so the main loop provably needs no range checks [llvm-irce]. Go prove covers a subset through its lattices without splitting [go-prove] (Part). Contract: emit the split under the same dominator-tree discipline and prove it with an F2-shaped fixture that must still trap exactly at the first out-of-range index. watching bck_irce_split Pros none measured yetCons behind Rust (leads), Zig, Go; open contract, nothing on disk yet	○	◉	●	◐	○
Energy per run on the receipt (RAPL package energy per arm) DARK — `runtime/nx_lang_h2h.nx` EXISTS but does not declare `h2_energy_arm`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ADMITTED 2026-09-01 from the operator ask to beat the field on energy efficiency, not only speed. The reference method is the Energy-Languages study: RAPL package counters around each benchmark run, 10 CLBG benchmarks across 28 languages, energy and time and memory measured per run [energy-languages]. Contract: the receipt gains an energy_uj column per arm read from powercap RAPL, and prints UNMEASURABLE by name on any host without RAPL exposure -- the laptop WSL2 host that produced every receipt so far has no /sys/class/powercap and no MSR device (measured 2026-09-01), so the first VALID energy column requires the estate host or a bare-metal runner. No language ships this on its own comparison page; scored 0 for all. watching h2_energy_arm Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
A lexer desync is attributed to the file and line that broke, never to the auto-appended crash handler Measured: `diag_desync_origin` exists in `runtime/nx_tokenizer.nx`, verified at emit. LN24. MEASURED 2026-09-02: a raw NUL inside a gate source produced twenty unknown-name errors at nx_crash.nx lines 36 to 99 (nx_compile_x86 expands the crash handler after every user file). THE CONTRACT: a control byte other than tab, LF, CR is refused by file and line, and an unterminated literal is reported at its opening line before any later file is expanded rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=71 nonval=67` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Compiler capacity limits are diagnostics naming the function, the cap and the count Measured: `diag_capacity_named` exists in `runtime/nx_ir.nx`, verified at emit. LN25. MEASURED 2026-09-02: nx_assert_lt idx=4096 cap=4096 tag=ir_block_new on a 253-name if-chain named the pool, not the function. THE CONTRACT: every cap reports the function, the cap, the measured count and the remedy rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=98 nonval=90` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Every diagnostic teaches in one voice: location, caret, why the build stopped, fix Measured: `diag_voice_gate` exists in `runtime/nx_diag_voice_gate.nx`, verified at emit. LN27. The parser's teaching sites already have the shape (nx_diag_caret plus why and fix lines); the LN24 desync messages first landed without it and the operator named the output as not helping a programmer grow. THE CONTRACT: a gate over every diagnostic emission site in the toolchain refuses a bare location; estate-wide, owned by the lang lane rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `GATE:LIVE trial=RED` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
A bare block statement is a scope Measured: `parse_stmt_block` exists in `runtime/nx_parse.nx`, verified at emit. LN32. MEASURED 2026-09-02: the parser had no production for `{ ... }` at statement start -- it fell into the expression fallback and its closing brace CLOSED THE FUNCTION EARLY, so three estate sources written with C-style inline blocks (a decimal printer used twice per function) had never compiled. Now a block is a scope: names declared inside die at its brace (block_base/n_locals, the for-body discipline); sibling blocks may reuse a name; a leaked name is refused by name. Fixture runs and returns the computed value (31); gate teeth in nx_dangling_else_gate. Every incumbent has block scope. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
A keyword at module level is named, not blamed on a brace Measured: `parse_module_stray_keyword` exists in `runtime/nx_parse.nx`, verified at emit. LN31. MEASURED 2026-09-02: a module-level `var g: i64 = 0` (module state is `static name: type`) and a stray top-level else both died on an assert that said ONE BRACE TOO MANY -- authors counted braces in a file whose braces balanced. Now the keyword names the cause (var: use static; let: use const or static; else/return/if/while: a function above closed early) with where, why and fix, and parsing continues so the end gate lists every problem. Teeth live in nx_dangling_else_gate (module-level var refused by name, static control compiles). rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
An else with no if is refused, never run Measured: `parse_stmt_dangling_else` exists in `runtime/nx_parse.nx`, verified at emit. LN30. MEASURED 2026-09-02 on nx_autofix_intake_gate: an if/else chain closed one brace early left `} else { ... }` hanging as a SECOND else; the parser reached it through the expression fallback, produced nothing, and the block after it parsed as a bare block that RAN UNCONDITIONALLY -- every admission-refused row was counted twice while the gate printed a partition that did not sum. Now an else that begins a statement is refused by name with where (caret), why and fix; else-if chains and plain if/else untouched. Gate nx_dangling_else_gate (silent-class fixture: pre-LN30 compiled it with exit 0). Every incumbent refuses a stray else. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
A field name must belong to the struct it is read from Measured: `parse_field_of_struct` exists in `runtime/nx_parse.nx`, verified at emit. LN29. MEASURED 2026-09-02: f.name_bytes on a Function (which declares name_start and name_len) compiled and printed junk -- every .f site returned the base pointer unchanged when the field was not found. THE CONTRACT: a struct that declares fields and does not declare this one is refused in the teaching voice, naming the struct and the fields it really has; an unresolved stub (no fields known yet) keeps the silent path the self-build relies on. Rust, Zig, Go and Elm all refuse an unknown field by name rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption:* `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Line tables ride every API build so a fault address resolves on the deployed binary Measured: `hc_build_debug_armed` exists in `runtime/_hdl_build/nx_hostctl.nx`, verified at emit. LN26. MEASURED 2026-09-02: a 16h /search outage began with the crash guard printing SIGSEGV @0x412767 and telling the reader to rebuild with -g; nx_addr2line refused the deployed binary (no .debug_line) and the source had moved. The whole chain existed (nx_cc -g, nxasm DWARF v5 .debug_line appended PAST the loaded image, nx_addr2line, nx_dwline_e2e_gate) and no build path passed the flag. THE CONTRACT: hostctl buildrun passes --debug while knowledge/status/build_debug.flag holds 1 (data-driven, reversible without a rebuild). Go ships DWARF line tables in every build (Best); Rust release profiles default to debug=0 with line-tables-only as an opt-in (Part); Zig keeps them in Debug and ReleaseSafe and strips ReleaseFast (Part); Elm compiles to JS without source maps (No) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Elm; fully adopted on the estate ladderCons behind Go (leads)	●	◐	◐	◉	○
wasm threads from the sovereign backend -- shared memory, atomic loads stores and rmw, wait and notify (lang LN33) Measured: `wat_mem_shared` exists in `runtime/nx_wasm.nx`, verified at emit. MEASURED 2026-09-03: the served world pages carry COOP same-origin and COEP require-corp, so SharedArrayBuffer is unlocked for them, and the sovereign wasm emitter has no threads to spend it on -- atomic.rmw ABSENT-PROVEN over 23506 runtime sources corpus_complete=1, no shared memory flag, no wait or notify. Rival cells coded at INDEX LEVEL from the banked bars and UNPINNED for this row: Rust and Zig expose the wasm atomics target feature, Elm has none, Go runs goroutines on one wasm thread rather than the threads proposal. Contract: the 0xFE-prefixed opcode family and a shared memory with a declared maximum from nx_wasm and nx_wasm_scalararm, lowered by nx_compile_wat, surfaced as an atomic intrinsic family beside the LN6 send marker; proven in a sovereign VM twin and in a browser over the CDP wire with two Workers on one counter. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	◐
The same atomic names lower to hardware on the native lanes -- LOCK-prefixed x86-64, rv64 AMO, futex wait and notify (lang LN34) Measured: `rv_home_t6` exists in `runtime/nx_riscv.nx`, verified at emit. OPERATOR 2026-09-03: one source, three lowerings -- the IR atomic family (__atomic_* builtins, nx_atom.nx) lowers to 0xFE on wasm (LN33), LOCK on x86-64 (pre-existing) and lr/sc + AMO on rv64 (LN34, source-landed, nx_rv64_atomic_gate 26/26 end-to-end on the sovereign sim, toolchain canary owed). Rust, Zig and Go lower atomics to the ISA natively; Elm has no threads. Contract: LOCK xadd, cmpxchg, xchg, mfence on x86-64, amoadd, amoswap, lr and sc on rv64, futex on Linux and the NishiOS wait queue, behind the same names, with the two-worker lost-update neg-control proving it. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=12 nonval=11` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Go; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	●
memory64 -- the wasm32 4 GiB wall as a declared choice, never a ceiling (lang LN35) DARK — `runtime/nx_wasm.nx` EXISTS but does not declare `wasm_memory64`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPERATOR 2026-09-03 (the browser is a door, never the ceiling): every address is wrapped to i32 today. Rust and Zig target wasm64; Go does not; Elm has no wasm backend. Contract: `(memory i64 MIN MAX)` behind a module declaration, the wraps dropped, the WAT compiler and VM twin carrying the flag, wasm32 emission byte-identical when undeclared. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching wasm_memory64 Pros none measured yetCons behind Rust, Zig, Elm; open contract, nothing on disk yet	○	●	●	○	◐
One source builds at a sensor's memory and at a supercomputer's: the wasm memory is a build-lane door, not a constant in the source Measured: `watd_atoi` exists in `runtime/nx_compile_wat.nx`, verified at emit. LN36. LN33 let a module declare its memory with statics, which is right for a wasm-only module and IMPOSSIBLE for a dual-target one -- nx_wasm_craft compiles natively too and the native lane refuses a non-zero static initializer by name. --shared <req> <max> moves the declaration to the build lane where the standing order says a target's limit belongs; --nothreads emits the unshared twin at the same size, so one source ships both artifacts. Byte-identical WAT when the flag is absent; both malformed forms refused by name; nx_wasm_threads_gate 37/37 on the NAS rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_wasm_threads_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Decimal literal machine: exponent form, 18 significant digits, sticky rounding Measured: `LEX_DEC_SIG_DIGITS` exists in `runtime/nx_tokenizer.nx`, verified at emit. LANDED 2026-09-03 rung LN36 and LN40. One digit machine feeds the integer and float tokens as (m, e10, sticky); 1e9, 2.5E-3 and 6.02e+23 lex, a 20-digit fraction costs a sticky bit instead of looping the compiler forever, and an integer literal needing a 65th bit is REFUSED by name rather than wrapped. Bound is u64 max because the estate writes unsigned bit patterns in decimal. Proven by nx_f64_gate 33 of 33 on the NAS. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=71 nonval=67` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Correctly rounded decimal-to-binary64 packing at any magnitude Measured: `fp64_from_dec` exists in `runtime/nx_quant.nx`, verified at emit. LANDED 2026-09-03 rung LN36 and LN40. Exact rational core when the significand fits 2^53 and the power of ten fits an i64; a 128-bit wide path otherwise (umulhi chunks of 5^25, one rounding at the end). Correctly rounded through 1e-43 and within 1 ulp beyond, exact wherever no bits are dropped. Peers: strtod-class conversion. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	●	●	●	●
Floating-point constant expressions Measured: `const_eval_f64_addsub` exists in `runtime/nx_parse.nx`, verified at emit. LANDED 2026-09-03 rung LN39. const NAME: f64 = EXPR folds with the same software IEEE-754 routines the f64 gate proves bit-for-bit against the hardware ops, so a folded constant equals what the program computes at run time. Before this only integer literals were accepted and every f64 constant had to be written as a zero-argument function. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=61 nonval=57` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Whole-population compiler census (every program, reason-classified, hang-aware) Source present; authored stronger claim: `lc_base_class` in `runtime/nx_langcensus.nx`, verified at emit. LANDED 2026-09-03. The incumbent compiler ruler nx_cc_equiv_gate runs 10 corpus rows; a sample can prove a mechanism and never a population. This organ compiles all 13790 top-level programs with a given compiler, classifies OK ERR HANG HARNESS with the reason attached, and against a baseline census NAMES every program whose class moved. It caught a 286-program regression that every fixture and the 10-row gate called GREEN. EXCEED: no peer toolchain ships a whole-corpus reason-classified refusal census as a first-class organ. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Rust, Zig, Go, ElmCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	●	●	●	●
RETRACTED-SEE-NOTE Bounds-check elision cost model DARK — `runtime/nx_bck_elide.nx` EXISTS but does not declare `bck_elide_cost_model`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 BY nx_bck_elide_gate AGAINST THE LIVE PROMOTED COMPILER, THREE SEQUENTIAL ROUNDS, SAME DIRECTION EVERY TIME. Elision is a large win on the div-free checked accumulate loop (h2h_A2_divfree no_elision 41266 / 41414 / 63498 us against with_elision 20711 / 21284 / 24547 us = 1.95x to 2.59x) and a consistent LOSS on the modulo-bearing arm (h2h_A_modulo no_elision 102547 / 112873 / 130564 us against with_elision 112529 / 116453 / 139372 us = plus 9.7, 3.2 and 6.7 percent). The pass therefore has NO COST MODEL: it elides wherever the dominance oracle blesses the site, including shapes where removing the check perturbs block layout or scheduling around a long-latency divide and costs more than the check it removed. The gate PUBLISHES both ratios and GATES NEITHER, so the win and the regression are equally invisible to every consumer -- nothing in the estate would have caught this. WATCHING bck_elide_cost_model: the pass must consult a cost model and DECLINE the elision where it does not pay, and the gate must GATE the modulo arm rather than merely printing it. SOUNDNESS IS UNAFFECTED IN EITHER DIRECTION -- a declined elision is always safe -- so this is a pure performance rung carrying no memory-safety exposure, which is also why it can be worked without re-blessing the dominance oracle. RETRACTED 2026-09-03 BY ITS OWN AUTHOR, SAME DAY: THE MODULO REGRESSION WAS MEASUREMENT NOISE ON A SATURATED BOX AND THIS RUNG'S PREMISE IS WRONG. The three rounds above were taken on the NAS while its write path was degraded, where run-to-run spread on that arm was 102547 to 130564 us -- 27 percent -- so a consistent 3 to 10 percent direction across three samples sat well inside the noise band and should never have been published as a finding. RE-MEASURED ON A QUIET HOST, 15 INTERLEAVED ROUNDS, minimal fixtures compiled by the same compiler with and without --bckelide: div-free median 8275 us plain against 5210 us elided = 1.59x WIN, and modulo median 45807 us plain against 44851 us elided = 1.02x with the min-max ranges OVERLAPPING (plain min 45302, elided max 45810). Elision is a LARGE WIN where the loop is check-dominated and NEUTRAL, not harmful, where a 20-to-40-cycle idiv dominates the body -- the physically sensible result, since the check costs a small fixed amount and a divide swamps it. THERE IS THEREFORE NO COST MODEL TO BUILD AND NO SHAPE THAT MUST BE DECLINED. THE REAL FINDING THIS EXPERIMENT UNCOVERED IS LARGER: the estate compiles EVERY organ in DEFAULT mode -- no build lane passes --mode at all -- so it builds itself in the slowest mode the language offers, while f1 (exactly --bckelide) is proven sound by nx_bck_elide_gate 13/13 and measures 1.59x here and 7105 against 4189 us on the published h2h receipt. That is a BUILD-LANE POLICY question and deliberately NOT a compiler-default change: the default-OFF contract is load-bearing (nx_compile_x86 states it -- default builds stay byte-identical by construction, which is what every drift and contentdiff instrument rests on), and flipping it estate-wide would re-baseline all of those instruments at the same moment, so the undo path would traverse the very comparison surface needed to judge the change. Superseded by the build-mode rung; this row stays open only as the record of a retracted claim. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching bck_elide_cost_model Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads); open contract, nothing on disk yet	○	◉	◉	◉	○
The estate builds itself in its FASTEST proven-sound mode, not its slowest DARK — `runtime/nx_ccbuild_lib.nx` EXISTS but does not declare `cb_mode_policy`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-03 AND IT IS THE LARGEST UNCLAIMED PERFORMANCE WIN ON THIS BOARD. No build lane in the estate passes --mode at all: a grep for mode=f1 across the build-lane sources returns one hit and it is a GATE, not a builder. So every organ ships compiled in DEFAULT mode, which by deliberate contract has every declared mode OFF -- including --bckelide, LN7 sound bounds-check elision, which is already written, already promoted, and already proven by nx_bck_elide_gate 13/13 against the LIVE compiler with both out-of-bounds legs still trapping 71. THE COST OF THAT, MEASURED TWO INDEPENDENT WAYS: the published h2h receipt reads nishilang-default 7105 us against nishilang-f1 4189 us on the same workload (1.70x), and a 15-round interleaved re-measure on a quiet host with minimal fixtures reads 8275 us plain against 5210 us elided (1.59x). On a divide-dominated loop the same comparison is 45807 against 44851, i.e. NEUTRAL -- so the mode is a win where it can be and costs nothing where it cannot. FOR SCALE: at 4189 us NishiLang-f1 BEATS rustc -O with bounds checks live (4445 us) and ties Go (4163 us) on the identical bounds-checked workload, while the default build we actually ship trails both by 1.7x. WATCHING cb_mode_policy: the build lane declares the mode it compiles organs with, as DATA, so the estate stops shipping its slowest mode by omission. DELIBERATELY NOT A COMPILER-DEFAULT CHANGE, and this is the load-bearing part: nx_compile_x86 states the default-OFF contract in its own source -- default builds stay byte-identical by construction, which is exactly what every drift, contentdiff and artifact-comparison instrument in the estate rests on. Flipping the language default would re-baseline ALL of those instruments in the same instant, so the undo path would run straight through the comparison surface needed to judge whether the change was safe -- the static-stability violation this estate already has doctrine about. The transition therefore belongs in the BUILD LANE, staged and per-target, with nx_behaveprobe proving output identity on each organ before its mode moves. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching cb_mode_policy Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads); open contract, nothing on disk yet	○	◉	◉	◉	○
Whole-corpus compile census -- every program in the tree compiled, partition reconciles Measured: `lc_class_name` exists in `runtime/nx_langcensus.nx`, verified at emit. The field's equivalent is a whole-ecosystem rebuild: Rust runs crater over crates.io and Go rebuilds the module corpus before a release. Ours compiles every top-level program in the tree and partitions ok/err/hang so the sum reconciles. MEASURED 2026-09-04: 13,784 programs, and the refusal count is only meaningful with a scope -- a laptop census is NOT an estate figure. Joining it against the estate's own sha256 manifest gives 135 closure-proven estate refusals, 119 unproven, 30 excluded, summing to 284. PARITY of method; the honesty of the scope label is the distance. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons behind Rust (leads), Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	●	◉	●
Closure-identity scope on any cross-tree claim -- a leaf-identity proof cannot carry a closure-level claim DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_closure_scope`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_closure_scope. No mainstream toolchain publishes a compile-refusal figure scoped by TRANSITIVE CLOSURE identity, because they build one tree; ours has two, and MEASURED 2026-09-04 that distinction moved a published claim from 284 to 139 -- a file byte-identical to the estate still failed here because a module it IMPORTS was stale. Done when the census resolves imports the way the builder does and stamps every row PROVEN or UNPROVEN by closure hash rather than by leaf hash. The exceed is structural: the rivals have no second tree, so the field has never needed this and does not have it. watching lc_closure_scope Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Compiler self-validation -- equivalence net plus self-host before any toolchain promote Measured: `eq_files_equal` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Multi-stage bootstrap comparison is the field's standard for trusting a compiler with itself; equivalence-modulo-inputs fuzzing is the research standard for finding the miscompiles a bootstrap cannot [emi2014]. Ours gates every toolchain promote on an equivalence net plus self-host and auto-rolls-back on a failed canary. Rust, Zig and Go all bootstrap (Best); Elm is written in Haskell and does not (No). Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons behind Rust (leads), Zig (leads), Go (leads); not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	◉	◉	◉	○
Mutation testing over the gate fleet -- a green that never had a red is unverified Measured: `gb_art_same_as_base` exists in `runtime/_hdl_build/nx_gate_bite.nx`, verified at emit. Mutation testing is a research-grade practice the compiler field rarely runs in CI; Rust has cargo-mutants as a community tool, the others none in-tree. Ours drives mutants through the SUBJECT as well as the test and reports NOT-SUBSTITUTABLE by artifact identity when a mutation cannot reach the binary, which is the failure mode that makes naive mutation testing report a vacuous pass. NOT coded as an exceed: running it is not the same as running it over the whole fleet, and the fleet sweep is bounded, so the honest reading is a stronger tool at unproven coverage. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_bite_sweep` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Zig, Go, Elm; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	○	○	○
Benchmark receipts with a declared control and a repro command Measured: `h2_refuse` exists in `runtime/nx_lang_h2h.nx`, verified at emit. Statistically sound measurement demands a control for layout and environment bias, not a single timed run [stabilizer2013]; Rust publishes perf.rust-lang.org and Go ships benchstat. Ours emits a RECEIPT carrying host, toolchain version, source and binary sha256, min and median, a checksum every arm must print, and the repro command, and REFUSES to grade when an arm's checksum differs. Measured on the promoted toolchain: 3.33x gcc -O2 and 1.6x Rust-checked -- not a peer on speed, and the page says so with the receipt attached. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of ElmCons behind Rust (leads), Go (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	●	◉	○
Diagnostics graded against the field's benchmark for human-readable errors Open — watching `runtime/nx_cc_sovereign.nx` : `cc_diag_grade`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Elm set the field's bar for compiler errors addressed to a person rather than a parser [elm-errors] and Rust adopted it. MEASURED 2026-09-04 on real refusals, the shipping compiler already emits the three-part shape -- a caret line, a why the build stopped clause, and a fix clause -- and names the enclosing construct: two definitions of X, the earlier one is at line N; this block is opened here and never closed. WATCH cc_diag_grade because none of that is MEASURED: done when a fixture set of known-bad programs is graded for span accuracy and suggestion correctness and the score is published here rather than asserted. watching cc_diag_grade Pros none measured yetCons behind Rust (leads), Zig, Go, Elm (leads); open contract, nothing on disk yet	○	◉	●	●	◉
Declared expect-fail fixtures -- a program whose purpose is to refuse must say so DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_expect_fail`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Every mainstream toolchain declares its negative tests IN the fixture: rustc compiletest annotates the expected diagnostic on the line, GCC uses dg-error, Go uses errorcheck. The estate has NO equivalent, and MEASURED 2026-09-04 that gap is live -- 7 of 135 proven refusals are deliberate negative controls, one of which states that if it ever builds the resolver has gone fail-open and its fix is refuted. FIXING THOSE ROWS WOULD DESTROY THE CONTROLS. The 7 was found by the fixtures' own vocabulary and is a FLOOR, not a total: sibling fixtures carrying no marker phrase are invisible to it. Done when a declaration field exists and the census partitions expect-fail from defect mechanically, the same conclusion organ_kind.conf and organ_gate.conf each reached from their own side. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching lc_expect_fail Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads), Elm; open contract, nothing on disk yet	○	◉	◉	◉	●
Dead-code and unwired-symbol census across the whole tree Measured: `uw_exported` exists in `runtime/_hdl_build/nx_unwired.nx`, verified at emit. Go makes an unused variable a compile error and Rust ships dead_code as a default-on lint; Elm's compiler reports unused values. Ours is a whole-tree census with a NAME-SET ratchet rather than a count, so a rise names the function and the file -- a count-only ratchet on a shared tree reports a regression without saying whose. PARITY of intent, and the name-set form is the part worth keeping. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separateCons behind Rust (leads), Go (leads), Elm (leads); not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	◉	●	◉	◉
Diagnostic object model rendered by three emitters DARK — `runtime/nx_parse.nx` EXISTS but does not declare `nx_diag_object`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH nx_diag_object. The 2026 bar is a diagnostic OBJECT (message tree, spans, fixes, optional graph) with several emitters from the one object: GCC 16 nests its errors, emits SARIF 2.2-track and experimental HTML and dropped its legacy JSON [gcc16], and rustc made one renderer library the only stable human emitter [rustc-annotate]. Done when nx_diag_caret is fed from one object that a nested terminal renderer, a kv or JSON sink and a line-oriented socket stream all consume; SARIF, HTML and graphs are deferred behind the object. watching nx_diag_object Pros none measured yetCons behind Rust, Zig (leads), Go, Elm (leads); open contract, nothing on disk yet	○	◐	◉	●	◉
Renderer snapshot corpus over the refusal census DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_diag_snapshot`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_diag_snapshot. rustc switched renderers only after matching the old output over its test corpus [rustc-annotate]. Done when the 13,721-program census (count printed) carries a stored rendering per refusal so a renderer swap is adjudicated by byte-diff count, and the negative control holds: a renderer that drops a nested child must show at least one differing snapshot. watching lc_diag_snapshot Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract, nothing on disk yet	○	◐	●	●	●
Machine-readable diagnostics validate against a pinned schema Open — watching `runtime/nx_cc_sovereign.nx` : `cc_diag_schema`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH cc_diag_schema. GCC validates every generated SARIF file against the schema in its testsuite and SKIPS when the validator is absent [gcc-sarif-schema]; SARIF 2.1.0 is the only published standard and 2.2 is an undated draft tree [sarif-tc]. Done when the 2.1.0 schema is mirrored and pinned, every machine-readable diagnostic the compiler emits validates against it, and a missing validator announces SKIP rather than passing. The 2.2 schema is a watch, not a target. watching cc_diag_schema Pros none measured yetCons behind Rust; open contract, nothing on disk yet	○	◐	○	○	○
Optimisation-directed fuzzing with a per-pass refinement oracle DARK — `runtime/nx_shapeprobe.nx` EXISTS but does not declare `sp_pass_directed`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH sp_pass_directed. Fuzzing directed by which optimisation pass changed, judged by a refinement oracle per pass rather than end-to-end output, found 55 new LLVM miscompilations [optimuzz]. The estate's differential EMI oracle (eq_build) is the end-to-end form; the per-pass oracle needs SMT-class semantics for the IR that do not exist yet, so this is LARGE and ranked behind the certificate unit below. No rival column ships it either. watching sp_pass_directed Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Mutators mined from the compiler own bug history DARK — `runtime/nx_shapeprobe.nx` EXISTS but does not declare `sp_mutator_from_bug`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH sp_mutator_from_bug. 587 mutators mined from 1,760 GCC and LLVM bug reports found 65 new bugs [issuemut]. Done when an extractor over the estate's own compiler-defect rows emits source-level rewrite rules and replays them through the fuzz lane; the prerequisite is that defect rows carry their triggering input, which the debt board does not yet require. watching sp_mutator_from_bug Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Lowering-rule verification kept fresh against the model Measured: `eq_build` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Cranelift committed to continuous formal verification of its lowering rules in CI after a stale-rule defect class [wasmtime-adv]. The estate's equivalence net and nx_gatefresh already re-prove lowering against the model on every build, so this row measures a bar the estate meets rather than a gap; not claimed as an exceed because the two are equal. Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	●	●	○	○
Certified compilation as the oracle; per-pass certificates as the unit DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_pass_certificate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_pass_certificate. CompCert 3.18 [compcert318] and Brack via CakeML [brack] are the certified-compilation oracles; the estate hosts no proof assistant and the field measures full verification at about ten times the cost of credible compilation [rinard10x]. Done when unreachable-code, dead-assignment and constant-fold each emit a certificate that a checker sharing no code with the pass accepts over the whole census (count printed) while the byte-identical self-host rebuild is preserved; a mutant pass that folds one constant wrongly must be refused naming the pass and site. watching opt_pass_certificate Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Missed-peephole two-axis harness DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_peephole_bench`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_peephole_bench. Agents cannot yet match humans on missed peepholes, and the benchmark scores soundness and profitability as two axes [peepholebench]. Done when each candidate rewrite is scored sound by the existing equivalence probe and profitable by instruction count, both printed, and an unsound-but-profitable rewrite is reported REJECTED rather than one of two. watching opt_peephole_bench Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Whole-ecosystem rebuild census with a named-reason spurious partition DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_rebuild_partition`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_rebuild_partition. Crater runs over 1,026,208 crates with a thirteen-way taxonomy that names spurious results by reason and re-runs only changed rows [crater159343]; the Fedora 45 mass rebuild is the distribution-scale routine [fedora45]. Done when, after a toolchain change, every downstream source is rebuilt and the receipt partitions regressed, fixed, spurious-regressed, spurious-fixed and unchanged with the spurious reason named (OOM, timeout, admission refused, diagnostic change), the partition summing to the population, and an admission refusal lands in spurious with its reason rather than in regressed. watching lc_rebuild_partition Pros none measured yetCons behind Rust, Go; open contract, nothing on disk yet	○	◐	○	●	○
Known-bug rows require an issue id and go RED on unexpected pass DARK — `runtime/nx_langcensus.nx` EXISTS but does not declare `lc_known_bug_id`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH lc_known_bug_id. rustc requires an issue number on every known-bug directive and its crashes suite goes red when a crash stops reproducing [rustc-directives]; lit and DejaGnu carry the same expect-fail and unsupported vocabulary [llvm231]. Extends LN48: done when a known-bug row without a debt or issue id is refused at parse, the row is GREEN only while the bad behaviour still fires, and an unexpected pass goes RED as a class distinct from ignore, with rows per class printed so zero of zero cannot read green. watching lc_known_bug_id Pros none measured yetCons behind Rust, Zig (leads), Go (leads); open contract, nothing on disk yet	○	◐	◉	◉	○
Backtracking register allocator fuzzed with generated functions DARK — `runtime/nx_x86_64_ctx.nx` EXISTS but does not declare `x86_regalloc_backtrack`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH x86_regalloc_backtrack. The successor to Cranelift's allocator is a backtracking allocator developed with generated-function fuzzing [regalloc3]. The estate's allocator watch (x86_use_regalloc) is the prerequisite; done when the allocator backtracks on spill pressure and a generated-function fuzz lane compares its output to the naive allocator by behaviour over a printed count of functions. watching x86_regalloc_backtrack Pros none measured yetCons behind Rust, Zig, Go (leads); open contract, nothing on disk yet	○	◐	●	◉	○
Masked and uncounted-loop vectorisation DARK — `runtime/nx_opt.nx` EXISTS but does not declare `opt_vec_masked`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH opt_vec_masked. GCC 16.1 vectorises uncounted loops and peels for VLA alignment with masked epilogues [gcc16]. LARGE and ranked in the third tier behind the integer reduction rung LN19; done when a loop whose trip count is unknown at entry is vectorised with a masked tail and the receipt prints the vectorised loop count against the census. watching opt_vec_masked Pros none measured yetCons behind Rust, Zig, Go; open contract, nothing on disk yet	○	◐	●	●	○
Bounded acyclic e-graph with a stochastic-search control DARK — `runtime/nx_eqsat.nx` EXISTS but does not declare `eqsat_bounded_acyclic`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH eqsat_bounded_acyclic. The 2026 workshop state pairs bounded acyclic e-graphs, the form Cranelift ships, with stochastic-search controls [egraphs2026]. The estate's engine (nx_eqsat_union) is the unbounded form; done when saturation is bounded acyclically with the bound as a conf row and a stochastic control run shows the bounded form finds the same rewrites on the census subset, counts printed. watching eqsat_bounded_acyclic Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Full-source bootstrap chain with an SBOM of the seed DARK — `runtime/_hdl_build/nx_bless_compiler.nx` EXISTS but does not declare `bc_seed_sbom`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH bc_seed_sbom. Guix 1.5.0 bootstraps from a hand-auditable seed and ships SBOMs for it [guix150], while rustc still starts from a downloaded prebuilt checked by repro-check [rust-stage0]. The estate self-hosts with stage2 equal to stage3 (eq_files_equal); done when the chain below the first sovereign stage is enumerated as data with hashes and a seed SBOM the bless organ refuses to install without. Third tier: LARGE. watching bc_seed_sbom Pros none measured yetCons open contract, nothing on disk yet	○	○	○	○	○
Reproducibility as a migration gate (bar; deploy DL14 owns the unit) Measured: `eq_files_equal` exists in `runtime/nx_cc_equiv_gate.nx`, verified at emit. Debian blocks unreproducible packages from migrating to testing since May 2026 [debian-repro-gate26]. The estate's self-host rebuild is already byte-identical (eq_files_equal); the promote-time build-twice refusal is deploy rung DL14, cross-cited so this board does not carry a second ruler. Adoption: `GATE:DEPLOYED-DARK trial=RED` — PARTIAL: deployed, no execution surface runs it: admit it to the gate roster. not adopted: deployed, no execution surface runs it: admit it to the gate roster Pros Implementing source symbol found; runtime acceptance separate; ahead of Rust, Zig, Go, ElmCons not adopted yet: deployed, no execution surface runs it: admit it to the gate roster	●	○	○	○	○
Superiority scorecard: every axis measured against every rival Open — watching `runtime/nx_lang_scorecard.nx` : `ls_scorecard`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN67. Superior is a number per axis per rival (speed on the h2h checksum, compile time, binary size, energy, the CWE classes the bug dumps blame, graded diagnostics, the tooling ring) reading WIN LOSE TIE or UNMEASURED, against the rival version named this month: Rust stable 1.98.1 [rust-releases-2026-09], GCC 16.2 [gcc16-changes-2026-09], Go 1.27.1 [go-release-history-2026-09], Zig 0.16.0 [zig-download-2026-09]; every rival publishes its own benchmarks and release notes, none publishes a head-to-head scorecard against its peers, so the cells code what they publish watching ls_scorecard Pros none measured yetCons behind Rust (leads), Zig (leads), Go (leads), Elm; open contract, nothing on disk yet	○	◉	◉	◉	●
Rival release bars as data on a beat Open — watching `runtime/nx_lang_scorecard.nx` : `ls_rival_bars`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. WATCH LN68. The four release pages fetched monthly, versions parsed into a pinned bar row so a WIN or LOSE always names the rival version it was measured against; the September 2026 cs.PL listing is the research bar beside them [arxiv-cspl-2026-09-22] watching ls_rival_bars Pros none measured yetCons behind Rust, Zig, Go, Elm; open contract, nothing on disk yet	○	●	●	●	●

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. rows with rival marks 81 · cited 23 · uncited 58. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code.

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-03	LN6	measure	The ranker moved LN6 to #1 once LN29 closed (target 2.0, M3). Measured the boundary first: nx_pool_submit(pool, fn, ctx: i64) has 40 call sites in 22 files; ~30 pass `p as i64` where p points at a per-task struct, the rest an integer or an address already in i64. The cast erases the type, so no marker anywhere says whether the struct may be read on the worker thread -- that is the CWE-362 hole the matrix row names. runtime/nx_sync_types.nx (the row's organ) never existed on either tree; the check lives in the parser, matrix organ repointed
2026-09-03	LN6	land	sync_send_check in nx_parse.nx (the watch symbol) + the `send` marker: `struct Job send { ... }` records the author's assertion (Rust's unsafe impl Send); under --sendcheck a ctx argument to nx_pool_submit that is a cast FROM a pointer to an unmarked struct is refused in the teaching voice naming the struct and showing the marker; a plain integer, an address, or a cast from an untyped u8/i64 buffer is ABSTAINED and the imprecision is declared in the source. --sendcheck is a driver flag and joins the `checked` mode row (the control), NOT `daily`, until the corpus is marked. Default builds emit nothing under either mode. nx_sendcheck_gate (13 teeth, four runtime fixtures: unmarked refused, marked compiles, integer abstains, default-build unchanged) bite-proven RED 6/13 against the pre-LN6 compiler and GREEN 13/13 after nx_bless_compiler NEUTRAL; nx_cc_equiv_gate 10/10 plus self-host GREEN; LN29 and LN27 gates still GREEN. Sources CAS-landed on the NAS as hunks; NAS toolchain build + promote_toolchain + gate ship follow
2026-09-03	LN6	queue	Corpus census under --sendcheck is running on the laptop (every func-main program); its count is the marking worklist -- each refusal names a struct that crosses the pool unmarked and needs the author's `send` decision, never a blanket mark. When that list reads zero the ratchet may move --sendcheck into `daily`
2026-09-03	LN6	measure	WHOLE-CORPUS CENSUS under --sendcheck (no sampling): 7598 top-level programs, refusing=75, and the refusals collapse to SIX structs (the marking worklist is per STRUCT, one author decision each, never per program): NxFq4mCtx (nx_f32_q4k_matmul.nx, the Q4_K matmul task context -- 53 programs, the whole LLM closure) · NxGraphNode (2) · Q8Ctx · Q5Ctx · PgCtx · NxMmtCtx (1 each). The plain-integer ctx sites (nx_nofloat_llm, the pool gates) abstained as declared. NxFq4mCtx holds only a_ptr/b_ptr/c_ptr and row bounds: each task owns a disjoint [jlo,jhi) slice of C and reads A and B immutably after submit, so it is the textbook `send` case -- but the mark is the author's assertion and is left for the lane that owns the matmul, with this row as its evidence
2026-09-03	autodev	land	The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 1788405975 (sev 5) autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix
2026-09-03	autodev	land	The autodev RED is CLEARED: nx_autofix_intake_gate RED 3/5 -> GREEN 5/5. Root cause was NOT admission per se -- the NAS build refuses the sandbox compiles (nx_sov_build_run exit 6) under the I/O storm, and the gate counted those as DISCARDED (a bug does not reproduce) when the build never ran at all. The NAS copy already distinguished BUILDER-ADMISSION-REFUSED -> UNEXAMINED (another seat); my patch added the NAMED CAUSE to a NO-FNRES discard (sandbox_rc, timeout, grader tail) so the one genuinely broken fixture reads its real error: nx_autofix_candidate5.nx:44 uses fib3..fib9 which are never defined (only fib1/fib2/fib10 exist) -- the teaching voice now surfaces it. This run: proposed=15 kept=6 unexamined=8. FILED debt 5 autodev/intake-partition-double-counts: the printed partition does not reconcile (kept+discarded+unexamined=30 vs proposed=15, discarded 16 > 15) -- discarded double-counts and the partition is not a tooth; autodev's lane to fix
2026-09-03	LN6	land	TOOLCHAIN PROMOTED on the NAS with LN6 (fourth canaried promote of the day): /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e3d31613 919760 B (parse_field_of_struct + sync_send_check + the send marker + nxcx_log derived lengths); contentdiff live->staged lost_from_live=0. The outgoing LN29 compiler fa7d8c6e is copied to knowledge/bank (a second promote pushes it out of .prev). --sendcheck is live in the served compiler under the checked mode; daily is unchanged until the six structs are marked
2026-09-03	LN6	land	nx_sendcheck_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN against the promoted LN6 toolchain (the served compiler refuses the unmarked fixture by name, accepts the marked one, abstains on the integer, and the default build is unchanged), promoted b0b93fdd, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN6's done-rule (a non-Send value handed to nx_pool_submit is refused, gate-proven) is met; the rung stays honest about scope: the check is name-keyed on the pool's one submit function, abstains on untyped buffers, and the corpus is unmarked, so the mode is `checked`, not `daily`
2026-09-02	LN27	land	nx_diag_voice_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 13/13 GREEN in the PROVE stage (the NAS sources carry 0 bare sites too), promoted cf2f5a08, _offc twin installed, registered, and hand-added to knowledge/gateroster.conf with its evidence named -- the LN27 watch symbol is now declared in the organ the matrix row names and flips on the next regen
2026-09-02	LN24	measure	NAS built nx_compile_x86 from the landed sources (staged e6fe9cf6 913840 B, src_sha 68ebd245 = laptop, closure 5786cad0); nx_contentdiff live -> staged lost_from_live=2, both runs NAMED: the old LN25 assert-tag fragments (blocks pool exhausted in function / split it: the cap is blocks PER FUNCTION), superseded by the diag_capacity_named voice; the first /api/promote_toolchain of it was CANARY-BLOCKED (build admission refused the canary compile under the I/O storm) and auto-rolled back to ea0314ce -- an untested toolchain never goes live; re-aliased and retried once admission read GRANT
2026-09-03	LN24	land	TOOLCHAIN PROMOTED on the NAS: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = e6fe9cf6 913840 B (the compiler with the measured-length expander walk, the first-wins desync recorder, diag_capacity_named and every voiced site), .prev = ea0314ce, the pre-session compiler 7a07a9cc kept in knowledge/bank. LN24, LN25 and LN27 are now live in the served compiler; their watch symbols are declared in the organs the matrix names
2026-09-03	LN29	land	parse_field_of_struct in nx_parse.nx is the ONE field resolver for x.f (the watch symbol; matrix row added, M1 ladder extended): a struct that declares fields and does not declare the named one is refused in the teaching voice naming the struct and the fields it really has; an unresolved stub (n_fields 0) keeps the silent return-base path the self-build relies on. Fixture p.c on Pair{a,b} reads error at _fx_ln29_bad.nx:6: struct Pair has no field named c, with caret, why and fix (a, b); the control compiles; nx_cc_equiv_gate 10/10 plus self-host GREEN; the voice gate counts the new site voiced (25/25 parser sites). Source CAS-landed on the NAS (four hunks). NOT promoted yet: a whole-corpus refusal census (every top-level program under the new compiler) runs first, then the canaried promote_toolchain
2026-09-03	LN29	measure	The first refusal the new compiler found was real and instructive: nx_tls13_server_session_recv_ch and emit_sh read and write session.client_offered_sup_ver, which the LAPTOP copy of Tls13ServerSession never declared -- every write landed at offset 0 of the session and every read saw a non-zero pointer -- while the NAS copy had declared it in the 2026-07-31 TLS-1.2 interop fix. Converged by adopting the NAS bytes (sha a05226d2); equiv GREEN again. Lesson: a laptop tree behind the NAS reads exactly like a compiler defect; converge the file before diagnosing the compiler
2026-09-03	LN27	land	nxcx_log in nx_compile_x86.nx now DERIVES every message length from the NUL-terminated literal instead of trusting the hand-counted second argument: an audit of its fourteen call sites found six counts that disagreed with the literal beside them (111 vs 114, 129 vs 131, 40 vs 38, 35 vs 34, 37 vs 36 twice) -- the small ones truncated the sentence, the large ones leaked the bytes after the literal into stderr (the expand_imports line printed two stray bytes before its why line). One chokepoint fix, no call-site change; the redundant nxcx_log(name, 0) before the explicit mode-name write removed; equiv 10/10 plus self-host GREEN, voice gate GREEN; source pushed to the NAS under CAS, rides the next toolchain build
2026-09-03	LN29	land	nx_field_of_struct_gate (source on the NAS, organ_kind oracle): assembles fx_bad (p.c on Pair{a,b}) and fx_ok in /tmp/nx_field_of_struct_gate/, forks the PROMOTED compiler on each with stderr captured, 11 teeth. BITE-PROVEN in the honest direction: against the pre-LN29 laptop compiler the bad fixture compiled rc=0 and six teeth went RED (the silent miscompile, measured); after nx_bless_compiler NEUTRAL installed the LN29 compiler (equiv + self-host green, game gate 127==127) the gate reads 11/11 GREEN. On the NAS it must stay UNSHIPPED until the LN29 toolchain is promoted -- its PROVE stage forks buildroot/_offc/nx_cc_sovereign.elf, which is still the pre-LN29 build; shipping it earlier would be a RED gate on a correct subject
2026-09-03	LN29	measure	WHOLE-CORPUS REFUSAL CENSUS (no sampling): every top-level program under runtime/ (7598 with a func main) compiled by the LN29 compiler on the laptop; refusing=1 and that one is the planted fixture _fx_ln29_bad.nx itself (removed from the tree afterwards). Zero real refusals: the corpus builds unchanged under the new rule, which is the done-rule's second conjunct. The compiler is therefore safe to promote estate-wide; the promote waits only for the queued NAS build that also carries the nxcx_log derived-length fix
2026-09-03	LN29	land	TOOLCHAIN PROMOTED on the NAS with LN29: /api/promote_toolchain target=nx_cc_sovereign.elf -> canary GREEN, prev banked; live buildroot/_offc/nx_cc_sovereign.elf = fa7d8c6e 915752 B (parse_field_of_struct live in the served compiler: an undeclared field on a declared struct is now a refusal estate-wide, proven safe by the 7598-program census). The pre-change compilers are durable in knowledge/bank (7a07a9cc pre-session, e6fe9cf6 voiced); the driver's derived-length nxcx_log rides the queued BQ-nx_compile_x86 build and its own canaried promote (admission refused three direct issues under the storm; the queue fires it)
2026-09-03	LN29	land	nx_field_of_struct_gate SHIPPED on the NAS through nx_organ_ship: fresh build proved 11/11 GREEN against the promoted LN29 toolchain (the served compiler refuses the undeclared field by name and compiles the declared control), promoted 9e4f9a03, _offc twin installed, registered, hand-added to knowledge/gateroster.conf with its evidence named. LN29 is DONE by its own done-rule: fixture refused with the struct and its real fields named (gate), corpus builds unchanged (7598-program census); the watch symbol parse_field_of_struct is declared in nx_parse.nx and the M1 ladder carries the rung

Risk register

Risk	Likelihood x impact	Mitigation
Any optimizer or backend change that promotes without the equivalence net ships a silent miscompile	certain x high	LN7 and LN8 done-rules require nx_cc_equiv_gate 10/10 plus self-host GREEN before promote_toolchain -- the canaried lane, never a hand copy.
Safety checks on by default break the 13,201-source corpus overnight	likely x high	LN1-LN6 ship behind a declared mode with the corpus building unchanged under the default; the ratchet flips the default per class only when the corpus is clean.
Complexity creep erodes the adoption exceed	possible x high	The Rust record is the control: every added annotation or keyword is weighed against the community's measured complexity fear; the capability-limit voice teaches instead of gatekeeping; the explicit-types stance stays.

Release history continued

When	Rung	Kind	Entry
2026-09-02	LN24	measure	nx_probe_hexesc: len=002 b0=195 b1=169 -- a high-byte hex escape in a string literal yields the two bytes; the earlier desync was a raw NUL written into source by a shell heredoc that collapsed the escapes, not a lexer gap
2026-09-02	LN25	measure	nx_html_entities: 112 names compiled; 253 names in one function overflowed ir_block_new at 4096 blocks; split by name length (2..8) the same 253 names compile
2026-09-02	LN24	land	Source-landed on the laptop in nx_tokenizer.nx (the lexer nx_compile_x86 actually imports; lex.nx is a test-only twin and was left byte-identical) plus the report in nx_compile_x86.nx: a planted NUL inside a literal now reads 'error at fx_nul.nx:3: the string literal opened at column 18 is never closed' and a planted 0x01 outside a literal reads 'error at fx_ctl.nx:3: a control byte (decimal 1) sits in the source at column 19', both file:line mapped, both fatal before the parser runs; nx_cc_equiv_gate 10/10 rows PASS plus self-host PASS verdict GREEN on the challenger. Awaiting the NAS toolchain build and promote_toolchain canary
2026-09-02	LN25	land	ir_block_new now builds its assert tag on the failing path only, naming the function (blocks pool exhausted in function <name> -- split it); a 2,300-branch fixture trips it at idx=4096 and names big. Same challenger, same equivalence verdict
2026-09-02	LN24	lesson	Statics are module-private in NishiLang: nx_compile_x86 could not see lex_err_kind ('I do not know the name'); accessor functions are the cross-module surface. And a one-line while/if with a struct-field index inside a braces chain tripped the tokenizer's @concat macro path ('@concat produced ...'); the plain multi-line form compiles -- a lexer-level hazard worth its own rung if it recurs
2026-09-02	LN24	retract	The lesson row above claimed a one-line while/if with a struct-field index tripped the tokenizer's @concat path. A minimal fixture (fx_concat.nx, one-line and multi-line forms) compiles rc=0 with the baseline compiler, so the claim is withdrawn: the message arose from an intermediate edit of nx_ir.nx, not from that construct
2026-09-02	LN24	queue	The teaching-voice report lives in nx_compile_x86.nx (the driver the laptop and the PE lane build) and the tokenizer/IR changes are shared; the NAS built nx_compile_x86 once admission opened, but /api/promote_toolchain accepts only nx_cc_sovereign, nxasm_x86_main or nx_sov_build_run, and this seat could not locate the sovereign compiler's driver source (no nx_cc_sovereign.nx under buildroot/runtime or its siblings; nx_catalog answered nothing under load). OWED to the lang lane: port the same report block to the sovereign driver's lex_source call site, build it, promote_toolchain; the tokenizer statics and accessors it needs are already on the NAS
2026-09-02	LN24	retract	The two LN24 messages as first landed state the fact without the estate's teaching voice (the parser's own errors print the offending line with a caret, then why-the-build-stopped and fix lines). The operator named them as output that does not help a programmer grow. Rewritten the same hour to that shape on the laptop and as a NAS hunk; the estate-wide standard is LN27 and belongs to the lang lane
2026-09-02	LN28	land	the intrinsic shipped as five anchored edits to the toolchain sources on both trees (nx_types, nx_ir, nx_parse, nx_x86_64_ctx twice, nx_x86_regalloc) plus nx_q4k_dot_simd2_lib and nx_q4k_simd2_gate; the laptop compiler is blessed (sha a9480db0), the NAS compiler waits on its own promote_toolchain canary under build admission; a consumer built with the old compiler fails to COMPILE rather than silently falling back, which is why the simd2 kernel lives in its own lib
2026-09-02	LN28	measure	nx_q4k_simd2_gate timing over 2000 rows of 14 super-blocks: simd (scalar unpack) 14.0 ms, simd2 (emitted unpack) 3.55 ms, 3.94x; the first gate run read 8 of 9 because the neg-control fixture drew a zero sub-block scale on 1 of 200 rows and a flipped nibble under a zero scale is arithmetically invisible -- the fixture now draws every scale non-zero and the zero-scale case stays covered lane-level
2026-09-02	LN28	lesson	the compiler emits intrinsics as raw VEX byte sequences, so a new AVX2 primitive never needs an assembler mnemonic; the encoding is proven by the consumer gate against an exact reference, never by inspection alone
2026-09-02	LN11	land	nx_lsp_gate ran 19 of 19 GREEN on the NAS through nx_job_run and is now ON THE GATE ROSTER (nx_gate_roster_run trial 3 of 3 green_or_skip, admit admitted_new=3); the language server had been REGISTERED-DARK since it shipped, a mention not a run
2026-09-02	LR3	land	nx_pkg_gate 19 of 19 GREEN on the NAS (CAS resolve, typosquat refused, zero install-time execution, hash-chained journal) and admitted to the roster with nx_gdbstub_gate (SKIP: stock gdb absent on the NAS, a precondition not a defect)
2026-09-02	LN9	queue	nx_srcfmt, nx_dbg_step_gate and nx_rvc_gate stay REGISTERED-UNAUTHORISED: no cap was ever minted for them, so no seat can run them; the unblock is one admin mint per tool (POST /api/cap/mint allow=<tool>), an admin-seat action, not more code
2026-09-02	LN9	land	the mint happened from the seat: a 30-day union cap for 14 lang and OS tools via POST /api/cap/mint with the banked admin cap; nx_srcfmt_gate 13 of 13 GREEN on the NAS through nx_job_run and admitted to the gate roster; nx_srcfmt now reads LIVE in nx_catalog
2026-09-02	LN12	land	nx_dbg_step_gate 29 of 29 GREEN on the NAS (statement stepping over an nx_dwarf_line table, never-brick teeth: zero ptrace call sites, a pid-shaped subject refused) and admitted to the roster; nx_dbg_step reads LIVE
2026-09-02	LN10	land	nx_inc_compile_gate 40 of 40 GREEN on the NAS (one ruler with nx_closurehash, corrupt index refused whole, toolchain-byte change misses) and admitted to the roster; inc_cache_lookup was REGISTERED-DARK since it shipped
2026-09-02	LR5	land	nx_langspec_gate 30 of 30 GREEN on the NAS (spec_conformance_run over the shipped compiler, absent-compiler abstains, clause coverage at the ratchet) and admitted to the roster
2026-09-02	LR6	queue	nx_osattest and nx_lang_h2h are now AUTHORISED under the same cap and still dark: their gates (nx_osattest_gate, nx_lang_h2h_gate) have not been run through the job runner and admitted yet, the same two-call recipe as above
2026-09-02	LN26	land	hc_build_debug_armed() in nx_hostctl cmd_buildrun appends --debug to the runner argv whenever knowledge/status/build_debug.flag reads 1 (flag written 1 this leg, data-driven disarm by writing 0); compile-proven locally with the hostctl change; NAS hostctl build queued BQ-nx_hostctl; the chain itself is proven on the NAS by nx_dwline_e2e_gate GREEN 21/21 (nx_cc -g, nxasm DWARF v5 .debug_line past the loaded image, nx_addr2line); remaining done-rule conjuncts: the first promoted --debug build answers nx_addr2line on the deployed binary and the byte-identity censuses accept the appended table
2026-09-02	LN24	retract	The LN24 attribution as first landed could not fire on a NUL inside a user file: nx_import expand_imports_inner walked every file as a NUL-terminated string (while src[p] != 0), so a raw NUL silently dropped the rest of that file before the lexer saw a byte of it and the open literal ran into the auto-appended nx_crash.nx -- the measured symptom, reproduced on the promoted compiler with a NUL-in-literal fixture (twenty errors at nx_crash.nx:36)
2026-09-02	LN24	land	nx_import.nx now walks by measured length (let n = *len_out; while p < n) in all four loops, so the NUL reaches the lexer; diag_desync_origin(kind, line, col, byte) in nx_tokenizer.nx is the ONE first-wins recorder and the watch symbol (matrix organ repointed from the lex.nx test twin to nx_tokenizer.nx); the fixture now reads error at _fx_ln24_nul.nx:3: the string literal that opens at this column is never closed, with caret, why and fix, and the control-byte fixture reads error at _fx_ln24_ctl.nx:3 (decimal 1); nx_cc_equiv_gate 10/10 plus self-host GREEN on the challenger
2026-09-02	LN25	land	diag_capacity_named(pool, name, name_len, measured, cap, remedy) in nx_ir.nx is the one voice for every capacity cap (blocks, SSA values and instructions PER FUNCTION; functions and globals PER UNIT): error at function <name>: the <pool> capacity is reached -- measured N against a cap of C, then why the build stopped and fix, exit 2; a 4200-arm fixture reads error at function big: the basic-block pool (blocks PER FUNCTION) capacity is reached -- measured 4097 against a cap of 4096
2026-09-02	LN25	lesson	f.name_bytes compiled on a *Function although Function declares name_start and name_len: the parser resolves a struct field by NAME across every struct, so a field of another struct reads garbage at a wrong offset with no diagnostic (the function name printed as junk until the fixture caught it). Admitted as LN29 below
2026-09-02	LN27	land	nx_diag_voice_gate.nx (symbol diag_voice_gate; matrix organ repointed to the gate): a census over 8 toolchain sources -- a site is a call to nx_diag_at or nx_diag_organ_at, an error: literal, an nxcx_log(nx_compile_x86: ...) line, an nxasm: FATAL literal or an error at function literal outside comments and definitions; a site is voiced when a why line (why the build stopped, why this matters, or an nx_diag_why_ call) AND a fix line (fix: or an nx_dym_note call) appear within 60 lines before the next site -- and it ratchets knowledge/status/diag_voice_ratchet.conf per file (tightens on a fall, never rewrites on a rise, prints BARE file:line as the worklist). Measured: 37 sites, 30 voiced, 7 bare at first sight; all 7 voiced this leg (parser too-many-problems, argument type mismatch, unreachable arm, non-exhaustive match, the build-found-N summary; the driver crash-guard-missing and validator notices; every bare driver failure and both assembler FATAL sites) -> 37/37 voiced, bare 0; gate 12/12 GREEN on the laptop, bite-proven RED 11/12 by deleting one fix line (names nx_compile_x86.nx:383 no-fix RISE) and GREEN again on restore
2026-09-02	LN24	measure	toolchain promoted on the NAS through /api/promote_toolchain (canary GREEN, .prev banked, pre-change compiler banked to knowledge/bank/nx_cc_sovereign.elf.pre-ln24ln25-7a07a9cc, verified 803170 B): live buildroot/_offc/nx_cc_sovereign.elf is ea0314ce 900368 B and carries the first LN24/LN25 hunks; the expander fix, the recorder and the voice edits are source-landed on the NAS under CAS and await the next toolchain build plus canary
2026-09-02	LN27	queue	NAS: build nx_compile_x86 from the landed sources, nx_stage_alias alias nx_compile_x86 elf.new nx_cc_sovereign, /api/promote_toolchain target=nx_cc_sovereign.elf (canary, auto-rollback), then nx_organ_ship nx_diag_voice_gate so the LN27 watch flips on the next regen; laptop proof GREEN already (equiv 10/10 plus self-host, voice gate 12/12, both fixtures)
2026-09-03	LN30	measure	nx_autofix_intake_gate printed proposed=15 kept=0 discarded=15 unexamined=15: its REFUSED-else closed one line late so `} else { SANDBOX-BUILD-FAILED }` hung as a second else, and the pre-LN30 compiler swallowed the `else {`, let that brace stand in for the missing one, and compiled the block as UNCONDITIONAL code (silent-class fixture: exit 0, 10,644 B of asm). The loud class (no missing brace) died on the module-level assert instead -- which names the wrong cause. Local corpus census over every program in the tree with the LN30 compiler: only the two planted fixtures refuse (final count lands in the promote row)
2026-09-03	LN30	land	parse_stmt dispatches TK_ELSE to parse_stmt_dangling_else (refusal voice: where + why + fix, recovery parses the block so later errors still surface); nx_parse.nx a5643d0f on BOTH trees (CAS); NAS toolchain BUILT 3697bb30 (920,944 B) staged as nx_cc_sovereign.elf.new, contentdiff vs live lost_from_live=0 over 2,146 runs, live compiler banked knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613 (919,760 B verified); laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green); nx_dangling_else_gate 14/14 GREEN vs the LN30 compiler and 7/14 RED vs the banked pre-LN30 compiler (bite-proven); gate source on the NAS, organ_kind oracle row, gateroster row, lang.matrix LN30 watch row, M1 ladder carries LN30. Intake gate itself fixed (brace) + T6 partition tooth and SHIPPED 84ec4b35 (6/6)
2026-09-03	LN30	queue	promote_toolchain target=nx_cc_sovereign.elf (canary) once the local census finishes clean, then nx_organ_ship nx_dangling_else_gate against the promoted compiler and roster it. LN31 candidate: the loud class and a module-level `var x: T = ...` both die on the STATEMENT-AT-MODULE-LEVEL assert whose text blames a brace -- module-level state is `static name: type`, and the compiler should say so
2026-09-03	LN31	measure	Two shapes died on the STATEMENT-AT-MODULE-LEVEL assert that blamed ONE BRACE TOO MANY: the loud dangling-else fixture (exit 200) and a module-level `var g_of_gv: i64 = 0` written while migrating the office gate onto nx_gate_verdict (braces balanced; module state is `static name: type`). The message named a cause that was not there
2026-09-03	LN31	land	the assert site now calls parse_module_stray_keyword (per-keyword voice, caret, why, fix, nx_diag_note_error, parsing continues); nx_parse.nx 089e9c8c on BOTH trees; laptop bless NEUTRAL BLESSED+VERIFIED (cc_equiv corpus+self-host green) for LN30+LN31 together; nx_dangling_else_gate 20/20 vs the new compiler and 10/20 RED vs the banked pre-LN30 compiler (module-var teeth included); lang.matrix LN31 watch row; ONE canaried toolchain promote carries LN30+LN31
2026-09-03	LN30	measure	Corpus census with the LN30 compiler over 13,774 programs (every func main under runtime/, laptop tree == NAS for the compiler closure): 2 refusals = the planted fixture + ONE real offender, runtime/_hdl_build/nx_archive_daemon.nx:500 -- a live daemon whose `} else { sys_close(cfd) }` hung as a second else on the /preserve route chain with main one brace short; the old parser ran sys_close after every routed request and never on a malformed one (fd leak). Fixed on both trees (44,457 B, both arms close), NAS build queued; the LN31 census runs next
2026-09-03	LN30	queue	nx_archive_daemon: fixed source built on the NAS (2,056,536 B debug-armed, sha 63759023) and staged as nx_archive_daemon.elf.new; /api/promote refused it as unclassified, so it is now declared `daemon` in organ_kind.conf -- which routes it to the health-checked /api/deploy. It is not a running service today, so bringing it up is an OPERATOR decision; the staged binary carries the fd-leak fix and waits there
2026-09-03	LN31	measure	LN31 census with the LN30+LN31 compiler over 13,781 programs: 8 refusals = 3 planted fixtures + 5 estate sources, and ALL FIVE already died under the pre-LN30 compiler on the module-level assert (exit 200) -- runtime/_hdl_build/nx_andelinwest_build.nx, nx_dev_pipeline_test.nx (an `if` at module level, line 81), nx_team_roster.nx (a `let` at module level, line 70), nx_vcodec_neural_entropy_gate.nx, nx_xlsx.nx. Zero NEW refusals from the promote; LN31 only names their cause. nx_xlsx.nx is the office xlsx writer whose promoted binary therefore cannot be rebuilt from this source (AHEAD class) -- a worklist row, not a promote blocker
2026-09-03	LN31	queue	repair the five module-level sources (each now prints where/why/fix): nx_xlsx first (the office depends on its promoted fossil), then nx_dev_pipeline_test, nx_team_roster, nx_andelinwest_build, nx_vcodec_neural_entropy_gate; re-run the census to zero real refusals
2026-09-03	LN30	land	TOOLCHAIN PROMOTED (LN30+LN31, one canaried promote): live buildroot/_offc/nx_cc_sovereign.elf = 4d8e7a40 / 923,280 B (the debug-armed mgmt build; contentdiff vs the previous live lost exactly the 3 removed assert strings), .prev = e3d31613 / 919,760 B (the pre-LN30 live, also banked at knowledge/bank/nx_cc_sovereign.elf.pre-ln30-e3d31613). The executed promote's edge reply was a 503 and the client retry read `no valid staged .new` -- the live hash and the rollback slot are the witnesses, not the receipt. nx_dangling_else_gate then SHIPPED against the promoted compiler: prove 20/20 GREEN (the behavioural canary), promoted e8a97dab, REGISTERED, rostered
2026-09-03	LN32	measure	The LN31 census named three sources refusing at module level for the SAME reason: an inline decimal printer `{ let d: *u8 = sys_mmap(8); var m ... }` used twice per function. The parser had no bare-block production -- `{` fell into the expression fallback and its `}` closed the function early -- so nx_dev_pipeline_test, nx_team_roster and nx_andelinwest_build had never compiled. The fourth, nx_vcodec_neural_entropy_gate, was a module-level `let F_ZERO` (now const). All four compile under LN32
2026-09-03	LN32	land	parse_stmt dispatches TK_LBRACE to parse_stmt_block (block_base/n_locals saved and restored, the for-body discipline); nx_parse.nx 00e0d57c on BOTH trees; fixture returns 31 at runtime; laptop bless NEUTRAL BLESSED+VERIFIED 0c550d99 (cc_equiv corpus+self-host green); nx_dangling_else_gate 24/24 vs the LN32 compiler and 12/24 RED vs the banked pre-LN30 compiler; lang.matrix LN32 watch row; M1 ladder carries LN32; LN32 census running; NAS debug-armed toolchain build in the next admission grant, then ONE canaried promote
2026-09-03	LN32	measure	LN32 census with the LN30+LN31+LN32 compiler: 13,780 programs, ZERO refusals -- the four block-idiom and module-const sources now build, the laptop xlsx copy is converged to the NAS bytes, and no planted fixtures remain in the tree
2026-09-03	LN32	land	TOOLCHAIN PROMOTED (LN30+LN31+LN32, second canaried promote of the session): live buildroot/_offc/nx_cc_sovereign.elf = a5702510 / 923,648 B (debug-armed mgmt build; contentdiff vs the previous live lost_from_live=0 over 2,160 runs), .prev = 4d8e7a40 / 923,280 B (also banked at knowledge/bank/nx_cc_sovereign.elf.ln30ln31-4d8e7a40, verified), canary GREEN in the receipt this time. nx_dangling_else_gate re-shipped against the promoted compiler: 24/24 GREEN, promoted a0859551, registered, rostered. LN30, LN31 and LN32 are DONE by their done-rules; nx_xlsx shipped f542ca90 through its fixed gate (office referee 2/2 GREEN); nx_archive_daemon fix staged behind an operator deploy decision
2026-09-03	LN31	retract	The earlier measure row called nx_xlsx an AHEAD fossil. WRONG SUBJECT: the census ran over the LAPTOP tree and the laptop copy of _hdl_build/nx_xlsx.nx was stale and carried an extra brace; the NAS copy has no such brace and compiles under the new compiler. The two copies are forked 42 hunks both ways (NAS: XF_MAGIC hoist + shared emitter migration; laptop: a different OF-S6 CF/DV block). Before naming an estate file broken, hash the NAS twin. Adoption direction is decided by nx_contentdiff of the promoted _offc/nx_xlsx.elf against a fresh NAS build, not by copy
2026-09-03	LN	measure	nx_dwline_stmt_gate reads RED 11/13 on the NAS after a rebuild from its source (a sentinel-loop fix in its .debug_line section match, unrelated to the two failing teeth): `neg-control-baseline-LACKS-statement-lines-6-and-10` and `new-row-count-strictly-greater` both FAIL because the BLESSED compiler now emits the statement-granularity .loc rows the gate's neg-control assumed it lacked -- OLD(blessed) L5=1 L6=2 L9=1 L10=2 total=6 equals NEW(stmt) total=6, s_bytes 31830 both. The differential oracle collapsed the day statement granularity was promoted into the toolchain; the gate is now measuring the toolchain against itself. Remedy for the lang lane: turn the neg-control into a pinned pre-statement compiler fixture (or drop the differential and assert the statement rows directly, which teeth 12-13 already do at L6=1 L10=1 from real addresses). Until then this RED is a stale oracle, not a regression.
2026-09-03	LN	land	nx_dwline_stmt_gate oracle RE-PINNED and served: the two collapsed differential teeth became `blessed-compiler-CARRIES-statement-lines-6-and-10-the-feature-is-promoted` and `new-row-count-equals-the-blessed-count-both-statement-granular` (with a positive-count neg-control so an empty agreement cannot pass); rebuilt on the NAS 96280e8c, promoted, /api/gate_run 14 of 14 GREEN. The gate now pins that the toolchain KEEPS statement granularity instead of demanding it add what it already has.
2026-09-03	LN30	measure	Debt 1788324631 (nx_browser ships UNGUARDED, sev 7) root-caused by crossing two compiler generations against two browser closures on the laptop: OLD compiler x Sep-1 closure = 0 crash-guard labels; OLD compiler x current closure = 1; NEW (LN30) compiler x Sep-1 closure = REFUSED at nx_media_deepcrawl.nx:111 with the dangling-else voice plus the desync guard `func inside a function body`. An instrumented lexer consumed every byte of the Sep-1 closure (pos==srcn==3078315, 473910 tokens, no skip-to-EOF), so the lexer is exonerated.
2026-09-03	LN30	lesson	A FUNCTION THAT OPENS FIVE IFS AND CLOSES FOUR IS ACCEPTED BY A PARSER WHOSE `else` ABSORBS THE MISSING BRACE -- AND THE PREPASS, WHICH COUNTS BRACES, THEN SWALLOWS EVERY FUNCTION AFTER IT IN THE CLOSURE. The crash guard is appended LAST, so it was the first casualty: find_function NULL at main entry, DCE drops the uncalled guard, the Rule-of-2 surface ships with no fault handler. The prior row blamed scale and a slot clobber; the discriminating control was the closure, not the compiler. LN30 refuses the shape at the source; the loud main-entry warning stays as defence in depth.
2026-09-03	LN30	land	nx_media_deepcrawl.nx fifth brace landed on the NAS (11279 B, was 10999, both trees dac0826c); LN30+LN31 compiler rebuilt on the NAS from 6f632e7a/089e9c8c = 4d8e7a40 (923280 B, supersedes the LN30-only 3697bb30 staging), nx_cc_equiv_gate 10/10 + selfhost GREEN, /api/promote_toolchain canary GREEN -> buildroot/_offc/nx_cc_sovereign.elf is now 4d8e7a40 (5th canaried promote; .prev = e3d31613); serving-root nx_compile_x86.elf aligned to 4d8e7a40 by /api/promote (two artifact roots, two promotes).
2026-09-03	LN30	queue	nx_browser rebuilt on the NAS against the fixed closure = 51f7b258 (2,458,208 B against a served 1,439,825 B: the swallowed tail was a megabyte of code, not just the guard), promote through nx_contentdiff so the served browser carries nx_crash_guard.
2026-09-03	LN30	land	nx_browser PROMOTED on the fixed closure: 51f7b258 (2,458,208 B; served was 1,439,825 B), nx_contentdiff GREEN lost_from_live=0 over 809 runs, _offc twin refreshed -- the served browser carries nx_crash_guard. Debt 1788324631 EATEN with the mechanism on its NOTE. (Appended through the new nx_fs_write append verb, EC27.)
2026-09-03	LN33	measure	FILED FROM THE BEACH 2026-09-03: /world/beach answers 200 with Cross-Origin-Opener-Policy same-origin, Cross-Origin-Embedder-Policy require-corp and worker-src self blob (nx_host_router emits them on every response), the served page constructs zero Workers and zero SharedArrayBuffers, and the toolchain is the first byte that is missing: nx_shelltool grep atomic.rmw over buildroot/runtime nx returned matches=0 files=23506 coverage_complete=1 corpus_complete=1. The isolation is paid; this rung is what spends it.
2026-09-03	LN33	land	LANDED ON THE LAPTOP TREE AND PROVEN 2026-09-03 (both trees owed the same bytes; NAS landing follows in this leg): nx_atomic.nx (the intrinsic family as single-thread reference bodies, 32- and 64-bit load store add sub xchg cas, wait32, notify, fence); nx_wasm.nx and nx_wasm_scalararm.nx intercept the call sites (the F618 pattern) and emit `(import env memory (memory MIN MAX shared))` plus `(export memory (memory 0))` when the module declares nx_wasm_shared_req and nx_wasm_pages_max, refusing a shared request without a maximum BY NAME; nx_compile_wat gains --nothreads (the unshared twin from one source); nx_wat_compiler learns the 0xFE family (15 mnemonics, natural-alignment memarg), memory imports, limits flags 1 and 3, and refuses a shared memory without a maximum; nx_wasm_vm executes the family with single-thread semantics and supplies an imported memory. NEUTRALITY PROVEN against a control build from the pristine emitter: fx_plain and nx_wasm_pong WAT byte-identical (371951 B). nx_wasm_threads_gate (26 teeth over forked subjects plus the in-process VM twin, two named neg-controls, the --nothreads scale-down proven to run) written and built.
2026-09-03	LN33	measure	THE BROWSER HALF OF THE DONE-RULE, MEASURED ON THE WIRE 2026-09-03 (nishi-ops/ac_cdp.py with the new AC_CDP_SERVE cross-origin-isolation server, headless Edge, real 20 s): crossOriginIsolated=true SharedArrayBuffer=true; two Workers over ONE shared WebAssembly.Memory each ran tick(64, 2000000) through i32.atomic.rmw.add -- final counter 4000000, exactly 2 x 2000000, zero lost; the plain-store twin tick_racy over the same shape read 2935692 (1064308 updates lost) -- the neg-control fired; wait32 in a Worker answered 1 (not-equal) and notify 0; the cmpxchg, xchg, sub and 64-bit probes read 7009, 40003002 and 10000000008, the same values the VM twin computes. The fixture bytes were 3246 B of wasm from a 1435 B NishiLang source.
2026-09-03	LN33	lesson	a NishiLang static must be ZERO-initialised on both lanes (nxasm refuses G3_NONZERO_INIT_STATIC), so a driver-settable emitter flag takes the OFF polarity; and a static declared between functions is not seen by the driver that imports the lib -- declare it at the module head. The gate's browser half cannot live in a NAS gate (no browser there), so it lives on the CDP wire and the gate says so in its own note rather than pretending.
2026-09-03	LN33	land	LIVE ON THE NAS 2026-09-03: sources landed under content compare-and-swap and hash-identical on both trees (nx_atomic.nx 5343c589, nx_wasm.nx ef63bff2, nx_wasm_scalararm.nx d6aee0d8, nx_compile_wat.nx 80808bb0, _hdl_build/nx_wat_compiler.nx 55d1f551, nx_wasm_vm.nx c7972b4d, nx_wasm_threads_gate.nx 6106a334); NAS builds admitted (src_path verified, src_stable=1) and PROMOTED with expect_sha256: nx_wat_compiler 74000 B fbfa0156 (nx_contentdiff GREEN lost_from_live=0, nx_behaveprobe on the real craft-world WAT IDENTICAL STRONG; the prior 58919 B stage was banked as .prev, not overwritten) and nx_compile_wat 713960 B 03ccb597 (nx_contentdiff RED on exactly three runs, all the pre-LN31 wording of the module-level parser diagnostic that a sibling lane re-voiced on 2026-09-02, so promoted with allow_capability_loss=yes and the three named here; nx_behaveprobe DIFFERS at offset 0 because the live driver printed per-function progress names to stdout ahead of the WAT while the rebuilt one routes them to stderr -- the WAT body is the same shape, and a stdout consumer now gets clean WAT). nx_wasm_threads_gate 107792 B 9d666f1f PROMOTED, REGISTERED, HAND-ADDED to knowledge/gateroster.conf and declared on knowledge/compare/lang.gates; run through nx_job_run against the SERVED binaries: 31/31 GREEN. The rung symbol on this board and on lang.matrix was corrected from the contract name wasm_shared_memory to the function that exists, wat_mem_shared, so the ranker can read the rung as landed. CORRECTION to the earlier land row: the gate has 31 teeth, not 26 -- a count recited in prose drifted within the hour, which is the reason counts belong in the verdict line and not in a note.
2026-09-03	LN33	retract	the first cut lowered a NAME-INTERCEPT on a new nx_atomic.nx lib beside the incumbent __atomic_* builtins / nx_atom.nx / OP_ATOMIC_* family (x86 already lowers those to LOCK) -- a duplicate ruler; retired reversibly to knowledge/retired/buildroot_runtime_nx_atomic.nx-1788443992 and the emitters now lower the IR OPS (wat_emit_atomic_op) plus the futex __syscall(98) to memory.atomic.wait32/notify; the discriminating experiment was nx_capsearch atomic naming the incumbent
2026-09-03	LN33	measure	gate 32/32 GREEN laptop against the rebuilt driver; bite: faa->sub RED 27/32, shared ignored RED 28/32, futex left no-op RED 29/32, restore hash-identical; browser (Edge headless, AC_CDP_SERVE COI): 2 Workers x 2000000 -> atomic 4000000 EXACT, racy 2277488, probe_futex 10, probe_cas 1009, probe_big 10000000003 on the 891-byte module
2026-09-03	LN33	land	nx_wasm.nx v2 + nx_wasm_scalararm.nx v2 + nx_wasm_threads_gate.nx v2 CAS-landed both trees; nx_compile_wat PROMOTED abdef773 712744 B (behaveprobe IDENTICAL STRONG on nx_wasm_pong; contentdiff lost=24 occurrences all the retired nx_atomic_* names) + _offc twin refreshed; nx_wasm_threads_gate PROMOTED 06928c21 107352 B + _offc twin (lost=56 all the old 32-bit fixture text); the promoted gate ran 32/32 GREEN on the NAS against the served binaries; unshared output byte-identical to the pre-LN33 control on pong
2026-09-03	LN34	land	nx_riscv.nx: rv_home_t6 + OP_ATOMIC_LOAD/STORE/FAA/CAS/FENCE lowered to fence rw,rw+ld+fence r,rw / fence rw,w+sd / amoadd.d.aqrl / lr.d.aqrl-sc.d.aqrl loop (labels .L<fn>_cas<id>, a7 as the 4th scratch) / fence rw,rw; nx_rv64_asm.nx: +12 RV64A mnemonics (.d/.w, bare and .aqrl), fence with iorw sets, slt family, bnez/beqz, .L labels admitted (ra_is_directive); _hdl_build/nx_rv64_atomic_gate 26/26 GREEN: assembler vs field-layout oracle, rv64im_min_sim executes the atomics, backend lowers every op, END-TO-END the backend's emitted tick(cell,1000) runs on the sim in 22053 steps and returns 1000 with cell=1000, probe_cas returns 1009; bite: faa->amoswap RED 24/26, cas bne->beq RED 25/26, store fence dropped RED 25/26, lr without aqrl RED 25/26, .L labels dropped RED 23/26, restores hash-identical; all three sources CAS-landed on the NAS (24208 / 110424 / 19764 B)
2026-09-03	LN34	queue	nx_riscv.nx is in the compiler closure: the NAS toolchain must be rebuilt + canaried (/api/promote_toolchain after nx_cc_equiv_gate 10/10 + self-host) before the rv64 lane serves it; NAS build of nx_rv64_atomic_gate launched (job 1788445673), then register + roster + lang.gates row
2026-09-03	LN34	lesson	A MUTANT THAT DID NOT APPLY READS AS A SURVIVOR: two backend mutants first survived 26/26 because the sed never matched a backslash-n inside a string literal -- assert mutated_lines>0 before every mutant build or the harness proves nothing (the NOT-REACHED class of nx_gate_bite, reached by hand)
2026-09-03	LN34	measure	rv64 had NO lowering for OP_ATOMIC_* (nx_riscv.nx printed # unhandled op; only OP_FENCE existed) and the sovereign text assembler nx_rv64_asm had no amo/lr/sc/fence, no slt/sltu/slti/sltiu/sra/srai/xori, no bnez/beqz, and DROPPED every .L label as a directive -- the backend's own loop could not be assembled; x86 lowering pre-existed (x86ctx_emit_atomic), so LN34's real gap was rv64 + the assembler
2026-09-03	LN34	retract	the queue row above named a TOOLCHAIN CANARY as the next door; measured by nx_catalog: nx_cc (the served x86 compiler) does not import nx_riscv.nx at all, and the rv64 driver nx_nxc is BUILT-UNPROMOTED on the NAS (605385 B fossil, never served), as is nx_main -- so the lowering reaches production through the organs that IMPORT nx_riscv.nx on their next build (laptop census of buildroot/runtime + _hdl_build: nx_main, nx_nxc and six nx_smoke_nxc_pipeline* sources), not through /api/promote_toolchain; nx_rv64_atomic_gate PROMOTED e7866f8e 871136 B, REGISTERED, _offc twin refreshed, RAN 26/26 GREEN on the NAS, declared on lang.gates with that receipt; remaining door = promote nx_nxc so an rv64 build is a served organ
2026-09-03	LN37	land	f64-compare op0-in-rax fix landed on the NAS toolchain source by CAS and promoted via canary (6cf44630, GREEN, prev a5702510 banked). Whole-corpus census 3267 programs zero G4 traps. Found by the CM4 quadrature gate.
2026-09-03	LN38	land	NaN unordered-compare guard landed in the same toolchain promote; nx_f64_gate grew two LN38 teeth, 27 of 27 GREEN with the fix and 26 of 27 RED against the banked pre-fix compiler (fixture exit 103).
2026-09-03	LN38	lesson	The ordering-key transform is a TOTAL order on the bit pattern, and a total order has no unordered element; IEEE-754 requires NaN to be unordered, so any comparator built on a total-order key is wrong on NaN by construction. The assembler had no ucomisd or jp, so the guard is integer arithmetic on the exponent and mantissa fields.
2026-09-03	LN36	queue	Three literal gaps found while writing the CM4 gate, each with a workaround so nothing is blocked: exponent form (LN36), f64 const-expr (LN39), large-fraction overflow (LN40). Recipes are in each rung note.
2026-09-03	LN36	land	Decimal exponent literals (1e9, 2.5E-3, 6.02e+23): the lexer is now one digit machine (value = m x 10^e10 with m the first 18 significant digits and a sticky bit for dropped digits) and fp64_from_dec packs it -- exact rational core when m below 2^53 and the power of ten fits an i64, a 128-bit wide path (umulhi chunks of 5^25) otherwise, correctly rounded down to 1e-43 and within 1 ulp beyond. Fixture nx_fx_f64_lit: 13 checks, every literal bit-equal to ONE IEEE operation on exact operands. Laptop toolchain 2aaa21ad blessed (equiv + self-host green); NAS sources landed by CAS hunks (tokenizer, quant, parse, compile_x86); NAS build b940c1fe staged; canary promote retrying under an admission storm.
2026-09-03	LN40	land	The compiler no longer hangs: a 20-digit fraction (sticky) and a 22-digit whole part (wide path) both pack; an integer literal that needs a 65th bit is REFUSED by name with the teaching voice (kind 3). Census over 13790 programs under the new compiler: 773 refusals vs 777 before, and the ONLY new ones are 4 -- the planted fixture and THREE real estate gates whose limb constants were always wrong (see queue row). nx_f64_gate LAYER 6 is 33/33 GREEN; against the pre-fix toolchain the literal fixture TIMES OUT (the hang, witnessed under timeout 20), the const fixture is refused and the overflow literal wrongly compiles.
2026-09-03	LN40	lesson	The first cut refused every decimal above i64 max and the census jumped by 286 refusals: the estate writes u64 patterns in decimal (FNV offset bases, all-ones masks, hash multipliers), so the bound is 2^64-1 and a decimal in [2^63, 2^64) is the unsigned pattern. Every fixture was green under the strict bound; only the whole-corpus census could see the class. A census whose compiler binary is rebuilt mid-run is contaminated -- run it on a frozen copy.
2026-09-03	LN39	land	const NAME: f64 = EXPR folds at compile time with the software IEEE-754 routines the f64 gate proves bit-for-bit against the hardware ops (+ - * / unary minus parens; int literals and int consts convert exactly; f64 consts chain). Fixture nx_fx_f64_const: 7 checks equal to run-time hardware bits. kind 2 in the module-const table; use sites materialise a TY_F64 constant.
2026-09-03	LN28	land	The Q4_K super-block dot intrinsic (OP_Q4KSBDOT const, ir_emit_q4ksbdot, x86ctx_emit_q4ksbdot and its dispatch) was a LAPTOP-ONLY fossil: the NAS toolchain sources lacked it while lang.plan called it landed. Landed on the NAS by CAS hunks (nx_types, nx_ir, nx_x86_64_ctx); the laptop and NAS toolchain sources now differ only in whitespace. Proof to run on the NAS once the canary promote lands: nx_q4k_simd2_gate (SOURCE-ONLY there today).
2026-09-03	LN40	queue	Three authored bigfloat gates carry a 20-digit limb constant above 2^64 and now refuse to compile: _bf_sinhcosh_gate_authored.nx:60 st[0] = 31622776601683793320, _bf_tan_gate_authored.nx:61 st[0] = 26457513110645905905, _f64_sinhcosh_gate_authored.nx:69 st[0] = 27182818284590452353. They compiled before only because the literal WRAPPED, so every result they graded used a wrong constant. The bigfloat lane owns the split into limbs; the refusal stays.
2026-09-03	LN41	measure	A DUAL-TARGET MODULE CANNOT CARRY THE LN33 MEMORY DECLARATION AT ALL, AND THE PROBE THAT PROVED IT COST ONE BUILD: nx_wasm_craft compiles BOTH natively (its gates import it) and to wasm, and adding static nx_wasm_pages_req/pages_max/shared_req made the native lane emit G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES five times and refuse. ROOT CAUSE READ FROM THE SOURCE, not guessed: nx_x86_64_ctx.nx x86ctx_emit_module_globals refuses a WRITABLE NON-ZERO static because .rodata is read-only on the GNU as/ld lane and 'nxasm IGNORES .data sections wholesale (nxasm_x86.nx:810)', leaving .lcomm (zero-fill only) as the sole both-lanes-writable form. The workaround is already documented in THREE other organs (nx_lawpath, nx_rv64_fast, nx_toolsafety_lib), so this is a recurring gap with a measured cost, not a one-off
2026-09-03	LN41	lesson	A STAGED ARTIFACT IS INERT BY CONSTRUCTION, SO nx_behaveprobe ON A STAGE SLOT REPORTS other_rc=127 other_bytes=0 DIFFERS FOR A PERFECTLY GOOD BINARY. content_put writes the .new without an execute bit and /api/promote is what sets the mode, so the probe exec'd a non-executable file. Read as a verdict it says 'the candidate is broken'; read correctly it says 'you probed a file nothing can run'. The promoted binary then ran 32/32 and 37/37 on the NAS. ⇒ for a laptop-shipped artifact, promote (which sets the mode) and verify by RUNNING it, or the probe indicts the wrong subject
2026-09-03	LN36	land	THE MEMORY DECLARATION IS NOW A BUILD-LANE DOOR, WHICH IS THE CORRECT DESIGN AND NOT A WORKAROUND: the standing order is that a target's limit is a declared door on a ladder, never a constant in the source, and ONE source must build at a sensor's memory and at a supercomputer's -- a static bakes one answer in. nx_compile_wat gained --shared <pages_req> <pages_max> (zero-init statics wat_shared_req/wat_pages_req_flag/wat_pages_max_flag, the only initializer the native lane accepts; zero means not-given so the LN33 module-global path is untouched). PROVEN: pong WITHOUT the flag is BYTE-IDENTICAL to the banked control, --shared 3 8 on a module with NO statics emits (import env memory (memory 3 8 shared)) plus the re-export, --shared 3 8 --nothreads emits the UNSHARED twin AT THE SAME DECLARED SIZE, and --shared 0 8 / --shared 9 4 are refused by name. nx_wasm_threads_gate 32/32 -> 37/37 GREEN on the NAS against the promoted binaries; nx_compile_wat promoted 6c6f5f4d 643364 B, gate promoted 1895335d 98850 B, both _offc twins refreshed
2026-09-03	LN41	lesson	A HAND-COUNTED LENGTH BESIDE A STRING LITERAL TRUNCATED THREE REFUSALS AND THE GATE CAUGHT IT: I passed watd_log(msg, 58/55/69) for messages that are 60/57/71 bytes, so every --shared refusal printed a CUT string. The refusals fired correctly and the teeth searching for their text failed -- the defect was invisible in behaviour and visible only in the assertion. Fixed by DERIVING the length (watd_logs walks to NUL). This is the estate's own banked law and I broke it anyway; the tooth is what made it cost minutes instead of a session
2026-09-03	LN41	lesson	RUNG IDS COLLIDE ACROSS CONCURRENT LANES ON A SHARED BOARD AND NOTHING CHECKS: I appended a rung as LN37 and four log rows as LN36, and BOTH ids were already taken by another lane's rungs landed the same day (LN36 decimal exponent literals, LN37 the f64 ordered-compare fix). The board accepted the duplicates silently -- a plan with two rungs sharing an id is the same coin-flip-wearing-a-schema defect organ_kind.conf was caught with, and the ranker reads whichever it matches first. Renumbered mine to LN41/LN42 after grepping for free ids. ⇒ GREP THE BOARD FOR THE ID BEFORE APPENDING A RUNG, and the durable fix is a uniqueness tooth in the compare referee rather than a habit.
2026-09-03	LR7	measure	nx_bck_elide_gate against the LIVE promoted nx_compile_x86.elf (923280 B) is 13/13 GREEN, elision proven dominance-gated, both OOB legs still trapping 71. Gate-published timings: h2h_A2_divfree_checked no_elision 41266 us vs with_elision 20711 us = 1.99x on the div-free checked accumulate loop.
2026-09-03	LR7	retract	WITHDRAWN: the 08-31 claim that the live toolchain provably lacks LN7 elision and that the single outstanding action is a toolchain promote of nx_compile_x86. That promote had already landed; live is 923280 B, not the 737605 B the claim was measured against. Discriminating experiment: one gate, two compilers, run SEQUENTIALLY -- run concurrently they share the constant fixture dir /tmp/nx_bck_elide_gate and clobber each other into a false SKIP.
2026-09-03	LR7	land	lang.matrix field 2 repointed runtime/nx_boundscheck.nx -> runtime/nx_bck_elide.nx (79958->79956) and the note carries the re-derivation (79956->81451). Both writes CAS-guarded, byte delta predicted and asserted.
2026-09-03	LN18	measure	nx_chkarith_jo_gate is 15/15 GREEN against the LIVE promoted compiler AND against the staged nx_compile_x86.sov.elf.new, with the anti-fallback neg-control BITE-PROVEN in both runs, so LN18 is already in the shipped compiler and the staged binary adds no capability over live.
2026-09-03	LN18	measure	DONE-RULE NOT YET MET AND SAID PLAINLY: this rung's bar is the daily mode within 1.3x of the default build on the accumulate loop; the receipt in the matrix note reads daily 10567 us and checked 10688 us against 7105 us default = 1.49x. LN18 is SHIPPED but has not cleared its own bar.
2026-09-03	LR7	queue	OPEN REGRESSION, not hidden: h2h_A_modulo_checked no_elision 102547 us vs with_elision 112529 us -- elision COSTS about 9.7 percent on the modulo shape. The gate publishes that ratio and gates nothing, so no instrument would have caught it.
2026-09-03	LR7	lesson	A matrix note that hand-asserts what the SHIPPED BINARY can do has nothing re-measuring it, so it rots -- and it rots in the PESSIMISTIC direction, which nobody audits. Two rungs on this board (LR7, LN18) were understated on the same day and each cost a full re-derivation. Symbol-presence is the WRONG instrument: LR7's symbol was in source the whole time while the note said the compiler lacked it. Only a GATE VERDICT AGAINST THE LIVE ARTIFACT settles a capability claim.
2026-09-03	LN28	land	The Q4_K super-block dot intrinsic is PROVEN ON THE NAS at last: nx_q4k_simd2_gate promoted and run there, 9 of 9 GREEN, simd_ns 54732469 vs simd2_ns 8953465 = 6.11x over 2000 rows of 14 super-blocks. It had been a laptop-only fossil while this board said LANDED -- the NAS toolchain carried none of OP_Q4KSBDOT, ir_emit_q4ksbdot or x86ctx_emit_q4ksbdot until today.
2026-09-03	LN36	land	Toolchain b940c1fe canary GREEN on the NAS (LN28 + LN36 + LN39 + LN40 + the u64 literal bound), prev 6cf44630 banked. nx_f64_gate rebuilt, promoted and run THERE: 33 of 33 GREEN, covering both refusal neg-controls (each asserting the diagnostic NAMED the defect, read from the compiler cclog) and both positive controls (largest i64 literal, and a u64-range decimal keeping its bit pattern).
2026-09-03	LN36	measure	nx_langcensus over the whole tree with the promoted compiler: 13718 top-level programs, ok 10195 err 3523 hang 0 harness 0, partition RECONCILES, 200 distinct refusal reasons. That err figure was then REFUTED by its own author -- see the lesson row.
2026-09-03	LN36	lesson	A NEW INSTRUMENT IS GUILTY UNTIL PROVEN, AND ITS FIRST RUN INDICTED ITSELF. nx_langcensus read 3523 refusals where an independent shell census read 773, and 2866 of them carried an EMPTY reason -- almost exactly the gap. Cause: tr_run_capture_to merges stdout and stderr, and the compiler writes the whole assembly to stdout (its own is 4178018 bytes), so a 256 KiB capture overflowed and every large program came back non-zero with no diagnostic. Fixed by sizing the capture from the largest measured assembly (16 MiB, mmapped once) AND by making a filled capture ABSTAIN as HARNESS rather than convict as a refusal, plus naming the no-marker class instead of letting it group as one blank cause. Re-run: error rate 25.7 percent to 6.4 percent, matching the independent instrument. TWO INSTRUMENTS THAT DISAGREE LOCATE A DEFECT NEITHER COULD FIND ALONE, AND THE CONFIDENT ONE WAS THE BROKEN ONE.
2026-09-03	LN36	queue	The census baseline lives at knowledge/status/langcensus.baseline with the compiler banked beside it at knowledge/status/ccbank/cc_live.elf. NEVER keep either in /tmp: the tmpstorereap beat destroyed the rows file at 13718 of 13790 rows and then the staged compiler, three times in one session. Next compiler change: run nx_langcensus <new-cc> <out> 60000 knowledge/status/langcensus.baseline and read the DELTA lines -- each names a program whose class moved.
2026-09-03	LN42	land	THE GAP IS CLOSED IN SOURCE AND PROVEN ON THE LAPTOP FARM. nxasm_x86 axc_apply_section now maps a bare .data AND .section .data to section 1 (the DATA TAIL) instead of the ignore bucket -- the one fact that made a writable non-zero static unemittable on either lane. nx_x86_64_ctx gained x86ctx_global_nonzero and emits every writable non-zero global as .data + .Lg<id>: + a .byte list in a block placed BEFORE the rodata stream (cursor 0 is aligned) with each entry padded to the next 8-boundary (always a full 8 when already aligned, deliberately: the content loop emits a trailing comma after every byte, so a zero pad would leave a bare .byte -- the empty-literal miscompile this file already carries a witness for). The G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES refusal is retired; only all-zero writable globals still take .lcomm and that path is byte-for-byte unchanged.
2026-09-03	LN42	lesson	A SOURCE HUNK'S BACKSLASH-n ESCAPES ARRIVE ON THE NAS AS REAL NEWLINES, SO A LANDED SOURCE IS NOT BYTE-EQUAL TO THE ONE YOU PROVED. Measured here: the landed emitter reads 210068 B against the proven local 209993, and reading the region back shows out_str(o, " .data\n") rendered with an actual line break inside the string literal. This dialect PERMITS a literal newline in a string so the two are semantically identical and it compiles the same -- but every local-vs-NAS hash comparison across that transport will differ even when the change is right, and any byte-identical claim made across it is unsound. ⇒ compare landed source by READING THE REGION, never by hashing it against the local copy, and treat a size delta after a hunk write as expected rather than as evidence of a bad write.
2026-09-03	LN42	measure	PROVEN THREE WAYS with the freshly built pair, none of it asserted: (1) the new compiler emits ZERO refusal lines and exactly one .data directive for a fixture carrying static answer: i64 = 42 and static tag: i64 = 1234567, the entry reading .Lg10: .byte 42, 0,0,0,0,0,0,0 then eight pad bytes; (2) the new assembler accepts it (rc=0, 7320-byte ELF) and the fixture RUNS returning 0 -- which it can only do if the initializer survived (a0==42), the slot is WRITABLE (a1==43 after a write) and the second static is intact (1234567), each with its own distinct non-zero exit code; (3) NEUTRALITY: nx_wasm_pong assembles BYTE-IDENTICAL between the old promoted compiler and the new one, so the .data block is skipped entirely when no such global exists. The standing witness is runtime/nx_ln42_probe.nx, landed beside nx_empty_lit_probe.
2026-09-03	LN42	queue	THE TOOLCHAIN PROMOTE IS DELIBERATELY NOT DONE. Both sources are landed on the NAS and read back correct, and the change is proven on the laptop farm, but a compiler goes live only through /api/promote_toolchain with its canary, and the NAS build to feed that canary is storm-refused and QUEUED (nx_build_admit, I/O storm). Remaining, in order: let the queued nx_compile_x86 build fire, build nxasm_x86_main, run the fixture against the NAS-built pair, then promote_toolchain (canaried, .prev-banked, auto-rollback) and re-promote the serving root -- two artifact roots means two promotes. ⚠nx_cc_equiv_gate reads RED (rows=10 passed=0) but it is the estate's documented MUTATION oracle that is vacuous without a challenger; the neutrality evidence that counts is the direct old-vs-new asm comparison above, and a whole-corpus sweep of it was started and did not finish.
2026-09-03	LN42	measure	NEUTRALITY, AT THE STRENGTH IT ACTUALLY EARNS: a whole-corpus sweep compiling every buildroot/runtime source with the OLD promoted compiler and the NEW one and comparing bytes reached 4932 of 12057 files before hanging on nx_fx_f64_elide.nx -- 4714 BYTE-IDENTICAL, 127 unbuildable by both (SKIP), 91 flagged DIFF. EVERY DIFF SAMPLED (nx_adhd_gate, nx_bills_gate, nx_codegrep, nx_accommodate_gate, nx_access_research_fetch -- 5 of 91) ADJUDICATES IDENTICAL WHEN RE-RUN SERIALLY: each produces ZERO bytes from BOTH compilers, i.e. it does not compile standalone and should have been a SKIP. ⇒ the DIFF column measures the SWEEP'S OWN CONTENTION, not the compiler: 24000 invocations of two ~900 KB compilers under load, through SHARED temp files, in the documented nondeterministic-failure class. The honest claim is therefore 4714 modules proven byte-identical and no adjudicated semantic difference -- NOT zero differences, and NOT whole-corpus coverage.
2026-09-03	LN42	lesson	A SWEEP THAT SHARES TEMP FILES MEASURES ITS OWN CONTENTION AND PUBLISHES IT AS A FINDING ABOUT THE SUBJECT. My neutrality sweep wrote every comparison through one o.s and one n.s; a stray reader (my own concurrent spot-check) and load-induced nondeterministic compile failures both land as DIFF rows that look exactly like real semantic differences. Worse, my first attempt to ADJUDICATE those rows ran WHILE THE SWEEP WAS STILL COMPILING, so the adjudication was contaminated by the same cause -- I varied two dimensions at once and briefly believed a correct change had regressed 57 organs. ⇒ give every iteration UNIQUE temp paths, re-adjudicate every non-SAME row SERIALLY with nothing else running before publishing it, and remember the earlier law's twin: the first sweep was killed and produced ZERO output because it buffered to stdout, which is why this one appends durably per row and could be read at all.
2026-09-03	LN42	lesson	THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- one says are these semantically the same text, the other says are these the same bytes -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears, run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong.
2026-09-03	LN42	retract	I PUBLISHED A FALSE LAW LAST PASS AND THIS RETRACTS IT: I claimed a source hunk's backslash-n escapes arrive on the NAS as REAL NEWLINES, so a landed source could never be byte-equal to the proven local one. REFUTED by the discriminating experiment I should have run before publishing -- a controlled probe carrying a bare backslash, a backslash-quote and a backslash-u through the SAME nx_fs_write path landed 36 bytes for 36 bytes with every backslash intact. The transport is FAITHFUL; nxmcp builds its body with json.dumps and ensure_ascii=False precisely so it stays that way. THE REAL CAUSE of the 75-byte gap was my own bookkeeping: my extraction script read the files with Python's DEFAULT universal-newline translation (CRLF collapsed to LF) and so reported reconstruct==local, while a raw newline='' read shows old+hunks = 210068 against a local 209993 -- a line-ending difference between my working copy and my reconstruction, NOT a corruption of what landed. Both changed regions on the NAS were read back directly and are correct. ⇒ A FALSE LAW PROPAGATES FASTER THAN A DEFECT, and the cost of this one would have been every future seat distrusting a write path that works.
2026-09-03	LN42	lesson	THE LAW THAT ACTUALLY SURVIVES: COMPARE FILES IN THE MODE YOU INTEND TO CLAIM. A universal-newline read and a raw read answer DIFFERENT QUESTIONS -- is this the same TEXT versus is this the same BYTES -- and I used the first to make a byte claim, then blamed the transport when the arithmetic disagreed. Read raw (newline='') for any byte-identity claim, and when a size delta appears run the cheapest experiment that can REFUTE your explanation before writing it down as a law. A controlled 36-byte probe settled in one call what two passes of reasoning got wrong.
2026-09-03	LN36	measure	nx_langcensus found the single largest refusal class in the estate: 314 of 13721 top-level programs refused with "a control byte (decimal 14) sits in the source here" -- larger than the next nineteen classes combined, and invisible to every gate because a source that cannot compile runs no test. Each carried ONE contiguous run of exactly 119 bytes of 0x0E sitting inside an integer-print helper, between the digit loop and its return.
2026-09-03	LN36	land	nx_ctlbyte_repair BUILT, PROMOTED and REGISTERED: a sovereign NishiLang organ that walks NAMED roots, locates the corrupt run, and classifies it by the contract the surrounding code pins -- INSERT-TAIL when the reversal and write were destroyed, DROP-RUN when only trailing cleanup was, UNKNOWN-SHAPE when neither, which it refuses to touch. Dry by default; --apply re-reads every file afterwards to prove the byte is gone. Repaired 314 of 314 on the laptop tree, all verified, tree now CLEAN.
2026-09-03	LN36	measure	THE REPAIR IS PROVEN BY THE INSTRUMENT THAT FOUND IT: a second census against the pre-repair baseline reads programs 13727 ok 13300 err 427 hang 0 harness 0 RECONCILES, delta new_err=0 new_hang=0 FIXED=320. Refusals fell 747 to 427 with nothing broken, and 13 of the recovered sources are on the gate roster -- their binaries had been running while their sources could no longer rebuild them.
2026-09-03	LN36	retract	I published that the corruption was present on BOTH trees. WRONG, and the discriminating measurement is the organ itself: reading actual bytes across 19272 NAS sources it reports affected=0 CLEAN. My both-trees claim came from grepping an od dump where the OFFSET COLUMN matched the octal I was searching for. A grep over a formatted hex dump is not a byte test.
2026-09-03	LN36	lesson	The laptop copies were AHEAD as well as corrupt: the NAS original prints "RED" where the laptop prints "verdict=RED", the token every last-line verdict reader anchors on. Adopting the intact NAS copies wholesale would have compiled the tree and DELETED that work. The reconstruction was behaviourally equivalent instead (one buffered write rather than k single-byte writes) and preserved the newer content -- proven by building and running the repaired gates, 11 of 11 and 17 of 17 PASS with the helper printing those counts. ★A CORRUPT FILE IS NOT AUTOMATICALLY AN OLD FILE, AND THE INTACT TWIN IS NOT AUTOMATICALLY THE ONE TO KEEP.
2026-09-03	LN36	lesson	The organ FIRST shipped with its roots hard-coded as runtime/, and on the NAS (CWD = the serving root, 17 files) it reported files=17 verdict=CLEAN over a tree whose sources live in buildroot/runtime/. ★A SCANNER POINTED AT THE WRONG ROOT PRODUCES A CONFIDENT, COMPLETE-LOOKING FALSE NEGATIVE. Roots are now arguments, the organ PRINTS the ones it walked, and a zero-file walk exits UNPROVEN instead of CLEAN (bite-proven).
2026-09-03	LN41	measure	The census made this class visible and then measured the fix: 40 programs refused with "I do not know the name K_MAGIC_65536", a name that IS declared on nx_crash.nx line 2. Every one was a single unbalanced brace in the program itself. After LN41, 40 of 40 name their own opening brace with file, line and caret -- other=0. Positive control: a healthy program still compiles unchanged (nx_quadrature_gate, rc=0, 153801 bytes of assembly).
2026-09-03	LN41	lesson	★★★★★★A STRUCTURAL BREAK REPORTED AT THE PLACE IT SURFACES SENDS EVERY READER TO A FILE THAT IS NOT THE PROBLEM. The token stream knew exactly where the brace was opened the whole time; nothing had to be inferred, only said. The tell that it was structural and not a missing symbol was the diagnostic pointing its caret AT a const declaration while claiming the name had no definition, plus a following error quoting comment prose as code.
2026-09-03	LN41	lesson	This class was invisible to every gate for the same reason the 0x0E class was: ★A SOURCE THAT CANNOT COMPILE RUNS NO TEST, SO ITS SILENCE READS AS HEALTH. Two of the three largest defect classes in the estate were only findable by compiling the whole population, which is the argument for nx_langcensus existing at all.
2026-09-03	LN28	retract	I PUBLISHED "LN28 PROVEN ON THE NAS 9 of 9 GREEN 6.11x". That claim measured the WRONG SUBJECT and I am withdrawing it. nx_q4k_simd2_gate mentions __q4k_sb_dot exactly once, in a COMMENT on line 192; it never calls the intrinsic. Its 9 of 9 and its 6.11x are real but they measure the __q4k_unpack32s path against the scalar ruler, not the whole-super-block dot. The discriminating experiment: the NAS parser contained ZERO occurrences of __q4k_sb_dot, so a program calling it could not have compiled at all.
2026-09-03	LN28	land	The intrinsic was BUILT AND UNWIRED on BOTH trees: OP_Q4KSBDOT in nx_types, ir_emit_q4ksbdot in nx_ir and x86ctx_emit_q4ksbdot plus its dispatch in nx_x86_64_ctx all shipped, and NOTHING routed the NAME in nx_parse, so every program calling it refused with "unhandled __ intrinsic". 32 such programs, found only by the whole-population census once its marker list learned the older parse_die vocabulary. Parser mapping added (4 operands); nx_q4k_dot_simd2_lib.nx, which could never compile, now builds to 12770 bytes of assembly; 31 of the 32 compile (the 1 holdout fails on an unrelated undefined name). Toolchain ef74425bab01636f canary GREEN.
2026-09-03	LN28	lesson	★★★★★★AN INTRINSIC IS NOT SHIPPED UNTIL ITS NAME REACHES ITS EMITTER: the opcode, the IR builder and the codegen can ALL exist, be reviewed, be landed on both trees and still be unreachable from every program, because the one line that maps the spelling to the builder is missing. And the gate that was supposed to prove it passed throughout -- its subject was a sibling intrinsic. ★A GREEN GATE PROVES WHAT IT CALLS, NEVER WHAT ITS NAME SUGGESTS; READ THE CALL SITES BEFORE BELIEVING THE VERDICT.
2026-09-03	LN43	retract	WITHDRAWN BY ITS AUTHOR, SAME DAY IT WAS FILED. The modulo regression (3-10 percent, 3 rounds) was NOISE: those rounds ran on the NAS with a degraded write path where that arm's own run-to-run spread was 27 percent, so a consistent direction over three samples was inside the noise band. Quiet-host re-measure, 15 interleaved rounds: div-free 8275 vs 5210 us (1.59x WIN), modulo 45807 vs 44851 us with ranges OVERLAPPING (neutral). No cost model is needed and no shape must be declined.
2026-09-03	LN44	measure	THE ESTATE COMPILES EVERY ORGAN IN DEFAULT MODE -- no build lane passes --mode. Default has --bckelide OFF, so the estate ships its slowest mode by omission while f1 is proven sound (13/13) and measures 1.59x locally and 7105 vs 4189 us on the receipt. At 4189 us f1 BEATS rustc -O checked (4445) and ties Go (4163); the default we ship trails both by 1.7x.
2026-09-03	LN44	lesson	A CONSISTENT DIRECTION ACROSS THREE SAMPLES IS NOT A FINDING WHEN THE INSTRUMENT'S OWN SPREAD IS FOUR TIMES THE EFFECT. I published a 6 percent regression measured on a box whose spread was 27 percent. The discriminating move was not more rounds on the same host -- it was a QUIETER HOST with a minimal fixture, where the effect either survives or dissolves. It dissolved, and chasing it would have bought a cost model for a phenomenon that does not exist.
2026-09-03	LN44	queue	THE FIX IS A BUILD-LANE POLICY, NOT A COMPILER DEFAULT, AND THE REASON IS THE UNDO PATH: nx_compile_x86's default-OFF contract keeps default builds byte-identical, which every drift and contentdiff instrument depends on. Flipping it estate-wide re-baselines all of them at once, so the comparison surface needed to judge the change would be destroyed by the change. Stage it per-target through the build lane with nx_behaveprobe proving output identity first.
2026-09-03	LN44	measure	THE 1.696x ELISION WIN IS UNREACHABLE FROM THE BUILD QUEUE AND THE CAUSE IS A PATH, NOT THE PASS. nx_compile_x86.nx read its mode table from ONE bare CWD-relative literal knowledge/lang_modes.conf, declared at line 120 and read at exactly one site, line 143 (nx_shelltool grep NXCX_MODES_CONF over buildroot/runtime returns matches=2 coverage_complete=1 corpus_complete=1). That file exists ONLY at buildroot/knowledge/lang_modes.conf, 1907 B; knowledge/lang_modes.conf is ABSENT from the serving root. The build QUEUE starts in the serving root, so a --mode=f1 build issued from the queue could never resolve the conf and would REFUSE, while the identical command from buildroot succeeded. CORRECTION TO THE BRIEF THIS LANE WAS GIVEN: the refusal exit is 9 (NX_COMPILE_X86_BAD_MODE), NOT 111 -- the 111 is the dead length argument of nxcx_log, which LN27 had already made untrusted because the function recomputes the length itself.
2026-09-03	LN44	land	MODE-CONF RESOLUTION FIXED BY COMPOSING THE INCUMBENT RESOLVER RATHER THAN WRITING A SECOND ONE. nx_compile_x86.nx 39544 B sha 2237f186 to 42406 B sha 7a34a429 in six CAS edits, every one verified by predicted byte delta. It now calls ct_readall_2dir from nx_comparetree_lib with its OWN dirs (position 1 knowledge/ and position 2 buildroot/knowledge/), which sizes its buffer from the file so it cannot short-read, and writes which position answered on EVERY path INCLUDING the miss. Only the GENERIC 2dir primitive is used, never the /compare wrappers, so the compare-side order adjudication cannot reach the compiler. The winning root is ANNOUNCED on the success path too, on stderr never stdout, because the two knowledge trees are FORKED rather than copies and a silent pick between two lang_modes.conf files would expand a mode from the one nobody was looking at. COMPILE-PROVEN: the laptop copy was made byte-identical to the NAS (both sha 7a34a429, 42406 B) and nx_sov_build_run --build-only returned rc=0 with an 866180 B artifact.
2026-09-03	LN44	lesson	A REFUSAL GUARDED BY A FLAG NOBODY PASSES YET IS A LANDMINE RATHER THAN A BUG -- IT CANNOT FIRE UNTIL THE DAY SOMEONE ADOPTS THE FEATURE, WHICH IS THE DAY IT COSTS THE MOST. The acceptance bar is therefore structural and not empirical: nxcx_expand_mode is the only reader of the conf and has exactly ONE call site, guarded by if nxcx_is_mode_flag(marg) == 1, so a build passing no --mode= never opens the file and can never refuse; and position 1 is the incumbent literal byte for byte, so ct_readall_2dir returns the same bytes for every CWD that resolved before and consults position 2 only where the old code had ALREADY refused. A refusal can become a success and a success cannot become a refusal.
2026-09-03	LN44	queue	BUILD QUEUED, NOT LANDED, ON THE NAS. /api/build target=nx_compile_x86 was REFUSED by nx_build_admit and the build did NOT run; the enqueue returned queue_launch_rc=0 queued=1 row BQ-nx_compile_x86, so it fires on the first nx_orchestrate pass with headroom. THE REFUSAL DESTROYED THE _build FOSSIL -- nx_catalog read BUILT yes 957128 B before and BUILT NO after, the runner reporting no artifact at buildroot/_build/nx_compile_x86.sov.elf -- so every staleness comparison against that path is measuring an absence until the queued build lands. nx_compile_x86 is TOOLCHAIN and must move via /api/promote_toolchain with its canary, never a plain promote; this lane deliberately did NOT promote it.
2026-09-03	LN44	lesson	THE TASK-3 PREMISE THIS LANE WAS BRIEFED ON WAS ALREADY REFUTED ON THIS BOARD BEFORE I WROTE A LINE. I was told elision is a REGRESSION on modulo shapes (102547 to 112529 us, minus 9.73 percent) and that the missing piece is an LN43 profitability heuristic. The sibling row log 1788476600 LN43 retract, filed minutes earlier by its own author, WITHDRAWS exactly that: on a quiet host over 15 interleaved rounds the modulo arms OVERLAP (45807 against 44851 us) and the apparent effect sat inside a 27 percent instrument spread. So NO cost model is required, LN43 is retracted, and the live rung is LN44. My four rows above were filed under LN43 and were RE-KEYED to LN44 in one all-occurrences edit; that edit returned 503, had in fact LANDED, and only a CONTENT read could tell, because LN43 and LN44 are the same length so the byte size was identical either way. LINKAGE WORTH STATING: the mode-conf resolution fix is the PRECONDITION for LN44's own done-rule -- a build lane cannot declare --mode=f1 from the queue while --mode= REFUSES from the queue, which is what the bare CWD-relative conf path guaranteed. READ THE BOARD BEFORE ACTING ON A BRIEF: a briefing is a snapshot, and this one was stale on a board that moves by the minute.
2026-09-03	LN44	land	MECHANISM SHIPPED, WIRING NEXT. nx_buildmode_lib (7900 B) makes the compile mode DATA -- knowledge/build_modes.conf rows target
2026-09-03	LN44	measure	THE SAFETY PROPERTY IS THE LOAD-BEARING TOOTH AND IT HOLDS: with no conf present the reader returns absent_conf_flags=0 AND absent_conf_keylen=0, so adopting this lib cannot change one byte of one artifact, and every existing build-cache entry stays valid. There is no flag day. A row is what changes behaviour, and only for the target it names.
2026-09-03	LN44	lesson	THE CACHE KEY WAS THE TRAP AND IT WAS NEARLY MISSED. nx_sov_build_run caches artifacts under sha256(expanded closure ++ compilerSha ++ asmSha ++ g-or-n). A mode that changed emitted code WITHOUT entering that key would serve an artifact compiled under the OTHER mode and present it as a cache hit -- silently correct-looking and wrong. bm_key_token exists so the mode enters the key by construction, and the gate asserts two modes can never share one. Read what a cache keys on BEFORE adding an input to the thing it caches.
2026-09-03	LN44	queue	WIRING IS THREE SITES IN nx_sov_build_run, all named: the cache key at sbr_cache_key (line 429, where want_debug already contributes g-or-n), the compiler argv at line 1406 (where -g is already appended), and one import. The proof that gates the wiring is BYTE IDENTITY: with no conf present, a target built by the wired runner must hash identical to one built by the unwired runner. That is the experiment to run before it ships, and it is cheap.
2026-09-03	LN46	measure	Measured over the whole class in the census baseline: parse_die refusals carrying file and line went 0 to 24 (parse_die itself), then to 43 (the unhandled-intrinsic site), then to 46 with still_bare=0 (the forward-const site). Toolchain b89d609234304148 canary GREEN. Example: a bare "unknown identifier in const-expression" became nx_arena_smp_gate.nx:38 with the source line and a caret on NX_MAGIC_2000000000 -- which is itself the next defect, a hoisted const that was never declared.
2026-09-03	LN46	lesson	★★★★★A DIAGNOSTIC WITHOUT A LOCATION IS A SENTENCE, NOT A DIAGNOSTIC -- AND IT IS ALSO UNGROUPABLE, SO IT HIDES ITS OWN FREQUENCY FROM EVERY CENSUS THAT WOULD HAVE RANKED IT. These 90 refusals sat in one blank class called "no recognised diagnostic marker" precisely because there was nothing in them to key on. Fixing the voice made the class countable, and counting it surfaced the __q4k_sb_dot unwiring underneath.
2026-09-03	LN46	lesson	The unhandled-intrinsic refusal now distinguishes two absences that need OPPOSITE actions and used to share one word: an intrinsic whose emitter exists but whose NAME was never routed is BUILT AND UNWIRED (fix the one missing line), while an intrinsic with no emitter anywhere is NOT IMPLEMENTED (the program is asking for a feature that does not exist). Measured the same day: __q4k_sb_dot was the first, __simd_vload_i64_x4 and __simt_thread_id are the second and are correctly refused.
2026-09-03	LN46	lesson	Two hand-counted string lengths (52 and 68) sat beside their literals at the forward-const site, the exact drift LN27 removed elsewhere; nx_diag_puts measures the string itself. ★A HAND-COUNTED LENGTH BESIDE A LITERAL IS A SECOND COPY OF THAT LITERAL SHAPE AND THE TWO DRIFT SILENTLY.
2026-09-04	LN35	measure	MEASURED 2026-09-04, corpus_complete=1: the wasm32 address wrap is 27 SITES across FOUR files -- nx_wasm.nx 14, nx_wasm_scalararm.nx 10, wasm.nx 3, plus the opcode-table entry in _hdl_build/nx_wat_compiler.nx (i32.wrap_i64 -> 17). The memory declaration is already a DATA mechanism to copy rather than invent: wat_mem_shared reads `static nx_wasm_shared_req` via wat_global_i64 and wat_mem_pages_max refuses a missing maximum BY NAME, with WAT_PAGES_SPEC_MAX=65536 enforced by wat_die saying the module could never instantiate -- a message that becomes FALSE under memory64 and must itself become flag-aware.
2026-09-04	LN35	queue	EXECUTABLE WORK ORDER, so the next seat does not re-derive it. DO NOT hand-edit 27 wrap sites: extract ONE helper wat_addr_narrow(o, ind) that emits i32.wrap_i64 under wasm32 and NOTHING under memory64, then migrate all 27 call sites to it. Rationale is the failure mode, not tidiness -- a single MISSED wrap under memory64 is a SILENTLY TRUNCATED POINTER, and 27 hand edits guarantee one is missed. The wasm32 path then proves its own neutrality: with no declaration the emitter must produce BYTE-IDENTICAL WAT to today, which is LN35's own done-rule. Order so every intermediate state is safe: (1) add wat_mem64 reading `static nx_wasm_memory64_req: i64 = 1`, mirroring wat_mem_shared; (2) add wat_addr_narrow and migrate all 27 sites while the flag is still always-off, proving byte-identical output; (3) ONLY THEN emit `(memory i64 MIN MAX)` in both forms and widen the ceiling to the wasm64 limit; (4) teach nx_wat_compiler the memory64 limits flag and the VM twin. UNTIL STEP 3 THE FLAG MUST REFUSE BY NAME rather than emit a 64-bit memory over wrapped addresses -- a module that declares memory64 and silently truncates is worse than one that cannot declare it at all.
2026-09-04	LN35	land	STEP 2 OF THE WORK ORDER LANDED AND BUILD-PROVEN, both WAT emitters. 22 of the 27 address-narrow sites collapsed into ONE wat_addr_narrow(o, ind) helper: nx_wasm.nx 12 of 13 (45966 to 46804 B) and nx_wasm_scalararm.nx 10 of 10 (36933 to 37668 B), the twin done in the SAME pass because a fix that lands in one organ and not its sibling is half a fix. Every edit predicted its byte delta and every prediction was EXACT: form A 19 B per site, form B 29 B per site, and the partitions reconcile (4+7+1 and 2+7+1). Builds GREEN: nx_compile_wat 646076 B sha 81493399, nx_compile_wat_scalararm 640822 B sha be37a2fe. The flag static wat_mem64_on is declared and permanently 0, so emitted WAT is unchanged BY CONSTRUCTION -- the helper body is byte-for-byte what wat_at_line does. HONEST GAP: the byte-identical-WAT proof is NOT yet run, because nx_behaveprobe needs a staged artifact and nx_stage_alias only aliases an existing .elf.new that /api/build normally writes; the sovereign lane writes buildroot/_build instead, and forcing it would mean a TOOLCHAIN promote, which is a canaried lane. So this is COMPILES-GREEN, not PROVEN-NEUTRAL.
2026-09-04	LN35	lesson	THE 27th SITE IS NOT AN ADDRESS NARROW AND MUST NOT BE FOLDED IN. The i32.wrap_i64 inside the emitted $nx_wasm_mmap helper converts the PAGE COUNT for memory.grow, not an address; under memory64 memory.grow takes i64, so it changes for a DIFFERENT reason. Folding it into wat_addr_narrow would be one name serving two unrelated decisions, which can then never be tuned for either -- and LN35's own done-rule already lists the mmap helper separately. Three more sites live in wasm.nx and are NOT migrated pending a liveness check, and one grep hit is the opcode-table entry in nx_wat_compiler.nx, which is a decoder row rather than a call site. PARTITION OF THE 27: 22 migrated, 1 deliberately excluded, 3 unmigrated-pending, 1 not-a-call-site.
2026-09-04	LN33	measure	THE FIRST EXTERNAL LIAR-KILLER HAS RUN AGAINST OUR SOVEREIGN WASM, AND IT PASSED. Subject: the served craft_mt.wasm, fetched over https at http=200 application/wasm 263990 B. Oracle: wasm-validate 1.0.39 (WABT), running OUTSIDE the estate exactly as the standing order requires -- it grades our bytes and never enters the build path. VERDICT: `wasm-validate --enable-all` accepts the module. THAT IS A SECOND METHOD CLASS: we did not certify our own wasm, an independent implementation of the specification did, which is precisely what our single-lens internal referee structurally cannot provide. THE FEATURE ENVELOPE, MEASURED BY BISECTION RATHER THAN ASSERTED: at MVP the module is REJECTED with `error: memory may not be shared: threads not allowed` at offset 0x000d5, and with --enable-threads it validates clean. So our shipped wasm requires EXACTLY ONE post-MVP proposal -- threads/shared memory -- and nothing more exotic. ★AND THE REFUSAL IS THE POSITIVE EVIDENCE: LN33 CLAIMED the wasm lane lowers atomics over a shared memory THE MODULE DECLARES, and a module that did not declare one would have validated FINE at MVP. The MVP failure is therefore an external confirmation that the shared-memory declaration is genuinely in the emitted bytes, not merely in our emitter's intentions. ⚠METHOD CORRECTION ON MY OWN COMMAND, recorded because it would have produced a false reading: I piped wasm-validate through `head`, so every `exit=$?` in that output is HEAD's status and not the validator's -- all three printed 0 including the failing case. The ERROR TEXT discriminates; the exit line does not. Same family as the truncating-consumer law: never put a filter on a call whose status you intend to interpret.
2026-09-04	LN13	measure	THE NISHILANG GAP IS NOW A PROVEN FACT WITH A RANK, NOT AN AREA. The estate ranker over this board reads rungs 51 done 42 open 9 with the partition summing, and for TARGET VERSION 2.0 at milestone M3 exactly ONE rung is on the critical path: LN13 capturing closures. Every other open rung ranks as later. The watch symbol parse_closure_capture is ABSENT-PROVEN over buildroot/runtime with matches 0, coverage_complete 1, corpus_complete 1 and no truncation marker, which is the only state in which absence may be asserted, so this is a real missing language feature and not an unwired one. Priority 800 from value 4 momentum 2 cost 10, deficit 4 against the rival columns, cluster 2, and the self-sufficiency row reads SOVEREIGN-NO-PENALTY because nx_parse carries no outside dependency.
2026-09-04	LN13	queue	DELIBERATELY NOT STARTED IN THIS SESSION, AND THE REASON IS THE SUBJECT NOT THE EFFORT. The contract is closures capturing BY VALUE into a compiler-emitted environment struct, with a gate proving a captured counter increments across calls and a capture of a moved value is refused once LN4 lands. That is parser plus environment layout plus codegen, estimated at 2 units with dependency LB0, and it lands in nx_parse which is the organ that builds every other organ in the estate. The standing law for this surface is that every intermediate state must compile and that the toolchain moves only through the canaried promote lane, alone, with nothing else building. Half-landing it at the end of a long session would put the whole build farm behind a partially applied parser change, which is the one failure this estate cannot absorb. The honest next step is a session that starts with this rung and nothing else.
2026-09-04	LN	measure	NISHILANG COMPILE-HEALTH: THE CONTROL-BYTE REFUSAL CLASS IS VERIFIED CLEAN AT FULL POPULATION (2026-09-04). nx_ctlbyte_repair DRY over the real source roots reports files=19331 affected=0 insert=0 drop=0 unknown=0 sum=0 RECONCILES verdict=CLEAN. That is the whole-corpus confirmation the 2026-09-03 repair never got: that pass fixed 314 sources which could not compile AT ALL and took refusals 747 to 427, and this says the class has not regrown anywhere in 19,331 files. A source that cannot compile runs no test, so its silence reads as health -- which is why this class deserves a population check rather than a spot one. ★★★★★★AND THE RUN BEFORE IT IS THE LESSON, MEASURED IN ONE PAIR OF COMMANDS: invoked with no roots from CWD=nishihost the SAME organ reported files=17 verdict=CLEAN. Same verdict, same wording, same exit -- from a population 1,137 TIMES SMALLER and the wrong tree. A GREEN OVER THE WRONG CORPUS IS BYTE-INDISTINGUISHABLE FROM A GREEN OVER THE RIGHT ONE, AND ONLY THE files= FIGURE DISCRIMINATES THEM. ★CREDIT WHERE THE DESIGN EARNED IT: the organ did NOT hide this. It printed `roots=runtime runtime/_hdl_build (DEFAULT -- name roots explicitly when the CWD is not the source tree)` on its own first line, so the trap was visible in the receipt and cost one re-run rather than a false estate-wide claim. That is the same CWD-relative class this session fixed in nx_swcompare_matrix, and it is the correct handling of it: an organ that cannot know its caller's CWD should ANNOUNCE its assumption rather than silently resolve. ⚠WHAT IS STILL UNMEASURED AND WHY I DID NOT MEASURE IT: the residual 427 refusals from the 09-03 census are NOT control-byte and their causes are unenumerated. Naming them needs nx_langcensus, which COMPILES EVERY top-level program (about 13,721 of them) and is NOT build-admission gated -- so running it during the current degraded-array storm would route hours of compile I/O around the very governor protecting those disks. DEFERRED DELIBERATELY, not forgotten, and the cheap unblock is named: the census takes an explicit <cc.elf> and REFUSES to guess a compiler (a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape as above), so it can be run on the idle laptop farm against buildroot/_offc/nx_cc_sovereign.elf the moment either the array recovers or a seat has hours to spend.
2026-09-04	LN13a	land	SHIPPED AND PROVEN ON THE DEPLOYED ARTIFACT. wat_die_unlowerable added to BOTH emitter twins nx_wasm.nx and nx_wasm_scalararm.nx, composing the incumbent wat_die so the file keeps exactly ONE exit path, and scoped to the no-arm fallthrough ONLY. The OP_SYSCALL arm above it still emits i64.const 0 and still stores its result, because that no-op is DECLARED behaviour for non-mmap syscalls and shipped modules pass through it harmlessly; the rule is no arm at all, never an arm I judge incomplete. Sources landed on the NAS hash-verified against the laptop, nx_compile_wat promoted a811c7f0a5a26dca at 646721 bytes with prev banked, gate nx_wat_refuse_gate promoted b09ead8e07fbffb8 at 38663 bytes and REGISTERED, and the gate then ran ON THE NAS against the LIVE compiler at 14 of 14 GREEN.
2026-09-04	LN13a	measure	NEUTRALITY AND THE BITE, BOTH MEASURED, NEITHER ASSERTED. Whole-population sweep of every wasm-targeted source in buildroot runtime with the pre-fix and post-fix compilers: population 85, identical 84, differs 0, refused 1, and the partition sums to 85. The shipping beach module nx_wasm_craft.nx emitted 10045460 bytes BYTE-IDENTICAL across both compilers. The single refusal is nx_video_codec_v1_adapter.nx at opcode 144 in nx_codec_encode, which is a REAL pre-existing silent miscompile and not a regression: nx_codec.nx line 115 calls through the encode_fn vtable slot declared on line 86, so every codec encode through the wasm lane silently returned zero while the build exited 0. Nothing feeds that adapter to the wat lane today so no live build breaks. The promote ruler read lost_from_live 4 with lost_srcpath 0, and all four are adjudicated: three are parser diagnostics superseded by strictly richer replacements visible in the GAINED list, and the fourth is the silent marker itself, whose removal IS the deliverable.
2026-09-04	LN13a	lesson	A BUILD FOSSIL IS NOT A FRESH MEASUREMENT, AND IT NEARLY SENT ME AT THE WRONG OPCODES. My first refuting experiment found the silent marker PRESENT in three emitted artifacts at opcodes 46 and 47, which reads as proof that a blanket refusal would break shipping builds. Both are atomics, OP_ATOMIC_STORE_I64 and OP_ATOMIC_CAS_I64, and the current emitter dispatches all five atomic ops at lines 584 to 588: those .wat files are pre-LN33 fossils in _build, emitted by a compiler that predates the arms. The evidence was true and its subject was stale. Re-emitting rather than reading fossils is what turned a false blocker into the real finding at opcode 144.
2026-09-04	LN13a	lesson	A TOOTH THAT PASSES FOR THE WRONG REASON IS AS DANGEROUS AS ONE THAT FAILS, AND ONLY THE BITE FOUND IT. My first gate asserted the refusal named its opcode by searching the merged capture for the bare substring 144. That tooth PASSED against the pre-fix compiler, because the silent marker it emits is literally ;; TODO opcode 144 -- so the one tooth meant to convict that binary was satisfied by the very string that proves it guilty. Fixed to the contiguous phrase cannot lower IR opcode 144, after which the pre-fix run moved from 9 of 14 to 8 of 14. A gate that has only ever been run against the fixed binary would never have shown this.
2026-09-04	LN13	measure	THE ROLLBACK CAUTION RECORDED AGAINST THIS RUNG IS TOO STRONG AS STATED, AND THAT CHANGES WHAT THE NEXT SESSION MAY ATTEMPT. A bad nx_parse.nx SOURCE is harmless to the live compiler until promoted: sbr_is_toolchain returns 1 for the five toolchain names so no build can install a compiler even under --install, and /api/promote_toolchain validates ELF magic and size BEFORE any rename, rotates prev to prev2, canary-compiles AND runs, and auto-rolls-back. Two generations survive. The dangerous half is the SOURCE EDIT and only to the 33 importers of nx_parse.nx, which is what the declarations-first edit order exists for. Three qualifications stand: the canary is 8 fixed integer checks with NO function pointers at all so it is structurally blind to LN13 and must not be counted as coverage; nx_cc_equiv_gate must be invoked EXPLICITLY on the staged artifact and only rows 10 passed 10 selfhost 1 accepted; and ma_do_promote_toolchain tests only sz == 0 while md_tc_install returns -2 on a provenance refusal, so a promote can return HTTP 200 TOOLCHAIN-PROMOTED with bytes -2 having installed nothing -- READ bytes ON EVERY PROMOTE RECEIPT.
2026-09-04	LN13a	lesson	MY OWN FIRST FLEET CENSUS WAS LESS THAN HALF THE POPULATION AND REPORTED A CONFIDENT ZERO. Paging a job artifact by trusting an empty next= field stopped at the READER's byte cap rather than at end of file, giving 683 rung rows over 67 domains with lang.plan missing entirely, from which the duplicate-rung-id census returned zero collisions. Re-paged with explicit offsets and small windows the real population is 1438 rung rows over 106 domains, lang's 60 rungs present and matching a direct count, and the true answer is 4 collisions in 2 domains. AN EMPTY CONTINUATION FIELD IS NOT PROOF OF EXHAUSTION, and a census that silently stops early fails in the flattering direction.
2026-09-04	LN	measure	WHOLE-POPULATION NISHILANG COMPILE CENSUS, RUN AND RECONCILED (2026-09-04). LANGCENSUS programs=13784 ok=13377 err=400 hang=7 harness=0 sum=13784 RECONCILES rows_written=547305, verdict=NO-REGRESSION with the organ correctly declaring itself a BASELINE rather than a judgement because no prior census was given. So 407 programs cannot compile at all, against the 427 the 2026-09-03 pass left behind. ⚠SCOPE LABELLED, NOT GLOSSED: this is the LAPTOP corpus at 19,458 files, not the NAS tree, so the 427-to-407 movement is NOT a proven improvement -- the two populations are not known to be identical and I did not compare them. What IS proven is the partition: every one of 13,784 programs landed in exactly one class and the sum reconciles. WHY IT RAN ON THE LAPTOP AT ALL: nx_langcensus COMPILES EVERY top-level program and is NOT build-admission gated, so running it on the NAS during the current degraded-array storm would have routed hours of compile I/O around the very governor protecting those disks. It ran instead on 16 idle cores against buildroot/_offc/nx_cc_sovereign.elf at ZERO NAS cost, which is the laptop-farm lane doing exactly what it was built for. ★CREDIT TO THE ORGAN'S OWN DESIGN: it REFUSES to guess a compiler, because a default path finds a stale binary and returns a fully formed verdict about the wrong artifact -- the same false-corpus shape that made a 17-file ctlbyte scan and a 19,331-file one print the identical CLEAN verdict earlier today. THE WORKLIST IS RANKED AND ONE CAUSE DOMINATES: `this block is opened here and never closed` at n=51 is roughly an eighth of every error in the estate from a SINGLE class, and LN41 already made that diagnostic name its own brace, so these 51 are precisely located rather than hunted. Behind it: undefined names (a long tail of n=1, each a genuinely missing symbol), ARITY MISMATCHES that are real call-site defects (wm_run called with 7 where it takes 8, vv_deblock and vv_deblock_plane with 4 where they take 5, ss_build_terms with 4 where it takes 5), 9 sites that compute a value and never use it so the work is thrown away, and DUPLICATE DEFINITIONS including nx_ts_verdict_is_valid defined THREE separate times at lines 6635, 6672 and 7691. ★★★★★★THIS IS THE LARGEST REFUSAL CLASS IN THE ESTATE AND IT IS INVISIBLE TO EVERY GATE BY CONSTRUCTION: a source that cannot compile runs no test, so its silence reads as health. 407 programs are currently contributing exactly nothing to any green anywhere, and until today nobody could name one of them. OWED: re-run against the NAS corpus when the array recovers and pass THIS run as the baseline argument, which turns the census from a snapshot into the regression detector it was written to be.
2026-09-04	LN	retract	PARTIAL RETRACTION OF THE CENSUS I JOURNALED TWENTY MINUTES AGO, WITH A CONTROL IN BOTH DIRECTIONS. I published programs=13784 ok=13377 err=400 hang=7 and labelled it LAPTOP corpus, which was the right hedge, but I then treated the 51 unclosed-brace rows as a worklist of ESTATE defects. THEY ARE NOT ALL ESTATE DEFECTS AND I CAN NOW PROVE IT BOTH WAYS. NEGATIVE CONTROL, a row that is NOT a real defect: nx_rv64_amo_gate.nx measured 8335 bytes on the laptop against 7491 on the NAS. Pulling the NAS copy and recompiling it with the SAME compiler produced a clean run -- nx_dce functions=287 live=141 pruned=146, no brace error at all. The ERR belonged to the LAPTOP COPY, not to the estate. POSITIVE CONTROL, a row that IS real: abr_t2.nx is 773 bytes on BOTH sides, byte-for-byte the same size, and its tail ends mid-token on the bare characters `std` -- a genuinely truncated source that is broken in the estate itself. ★★★★★★SO THE CENSUS IS A VALID MEASUREMENT OF THE CORPUS IT SCANNED AND AN INVALID ESTATE FIGURE, AND THE DIFFERENCE IS INVISIBLE FROM THE OUTPUT: every ERR row looks identical whether its cause is a real defect or local rot in a stale mirror. ATTRIBUTION IS PER FILE AND THE PROCEDURE IS CHEAP NOW THAT THE INBOUND DOOR EXISTS -- pull the NAS copy, recompile, and compare; roughly twenty seconds each. ⚠THE TRAP THIS AVOIDS IS SPECIFIC AND EXPENSIVE: 51 rows presented as a fix-list would have sent the next seat editing sources that are ALREADY CORRECT ON THE NAS, and every such edit would have shipped laptop rot INTO the estate under the banner of fixing it. A STALE MIRROR PRODUCES ERRORS THAT ARE INDISTINGUISHABLE FROM DEFECTS, AND THE ONLY DISCRIMINATOR IS A FRESH PULL. WHAT SURVIVES UNCHANGED: the partition still reconciles at 13784, the census organ behaved correctly throughout, and the class RANKING is still the useful output -- unclosed-brace dominating at n=51 is a real signal about where errors cluster even when individual rows need attribution. WHAT IS OWED, and it is now the only honest way to get an estate number: re-run the census against the NAS corpus when the array recovers, passing this run as the baseline argument. Until then NO estate-wide refusal count should be quoted from it, including by me.
2026-09-04	LN	measure	THE 51 UNCLOSED-BRACE ROWS ARE ATTRIBUTED AND THE PARTITION RECONCILES, WHICH DISCHARGES WHAT MY RETRACTION LEFT OWED. ATTRIB51 declared=51 examined=51 banked=51 compiles_after_pull=43 still_err=7 pull_failed=1 sum=51. Method: bank the laptop copy, pull the NAS copy over it through the inbound content lane, recompile with the same compiler, classify. So the estate has SEVEN unclosed-brace sources, not fifty-one, and 84 percent of that census class was stale laptop mirror exactly as the negative control predicted. The seven real ones are abr_t2.nx, nx_antipattern_catalog.nx, nx_fbo_s2.nx, nx_flg_t2.nx, nx_frp_t1.nx, nx_delivery_report.nx and nx_gen_authz_gate.nx. The single PULL-FAILED row is nx_vcodec_dct2_rd_gate.nx, answered CG-IO cannot open source, i.e. a laptop-only file absent from the NAS entirely -- it stays in its own bucket rather than being folded into either real class, because a row you could not attribute is not a row you may count. ROOT CAUSE FOUND AND IT COLLAPSES 42 OF THE 43: those files carry the marker MIGRATED onto nx_gate_verdict by nx_gate_dry_apply, and the D001 minimal-form substitution is defective in TWO ways at once. It leaves the gv_verdict call INSIDE the enclosing if pass==1 block, CONSUMES that block's closing brace so the function is never closed, and DELETES the RED emission branch outright. Proven by reading the source, not inferred from a diff: in nx_gen_authz_gate line 40 opens if pass==1, line 50's brace closes THAT, and main is never closed, which is why the compiler names line 21. A sibling still on its pre-migration NAS copy retains g_puts verdict=RED at line 77 while the migrated copy contains the string zero times. ★★★★★★THE LOUD HALF OF THAT DEFECT IS WHAT STOPPED THE SILENT HALF FROM SHIPPING. Had the brace arithmetic been right, these gates would compile and print NOTHING AT ALL when they fail -- a gate whose exit code and output both vanish on the RED path -- and nobody would have found it by reading a green board. The compiler refusing is the only reason 42 of 43 never reached the estate. ONE DID REACH IT: nx_gen_authz_gate was broken ON THE NAS and could not build at all. FIXED AND SHIPPED THIS SESSION, not filed: hand-migrated onto PER-TOOTH gv_check rather than restoring the pre-migration copy, because the machine form set ctr[0]=pass and ctr[1]=1, and a one-state judge reports passed 1 of 1 and cannot say which conjunct dropped. It now runs 5 of 5 GREEN with both deny cases named neg-control- so the L2 census can see them, emits five values through gv_kv for independent adjudication, and carries its verdict in its exit code. NAS artifact verified at 3859 bytes, not trusted from the receipt -- nx_fs size still served the pre-write 2928 for a minute afterwards, the read path lagging the write path on this surface too.
2026-09-04	LN	retract	PRECISION AND ONE SELF-INFLICTED CENSUS ERROR ON THE ROW ABOVE, PLUS THE SILENT-DEFECT SCARE RESOLVED TO NOTHING. FIRST THE ERROR, BECAUSE IT IS THE INSTRUCTIVE PART. I sized the migrated population by grepping the marker AFTER the attribution run had already pulled 43 NAS copies over their laptop twins. Those NAS copies are PRE-migration and carry no marker, so the very files whose defect I was measuring had silently left the population, and the sweep returned MIGSWEEP examined=841 compiles=834 brace_broken=1 -- a reassuring number produced by a census whose reference I had re-baselined myself, one hour earlier, with my own repair. ★★★★★★A CENSUS RUN AFTER A REPAIR MEASURES THE REPAIR, NOT THE DEFECT, AND IT FAILS IN THE FLATTERING DIRECTION. Reconciled against the banked originals the true population is 885 = 841 surviving on disk + 44 banked pre-pull, and the brace-break rate is 44 of 885, about 50 per thousand. That partition closes exactly: of the 44, 42 have clean pre-migration copies on the NAS so the broken migration never shipped, 1 is nx_gen_authz_gate which DID ship and is now fixed, and 1 is nx_vcodec_dct2_rd_gate which the inbound door answered CG-IO cannot open source, i.e. laptop-only. 42 plus 1 plus 1 is 44. SECOND, THE SCARE I DID NOT PUBLISH AND WHY. Having found that the migration deletes the RED branch, I suspected a fleet-wide SILENT defect: gates that compile but emit nothing when they fail. A first-draft 12-line context grep answered 217 files. I refused to publish it and tested it properly, and both refinements collapsed. A brace-depth counter over all 841 returned 28 non-conforming files, but it also returned NEGATIVE depths, which is a counter telling you it cannot parse -- braces inside string literals. Hand-adjudicating two of the 28, nx_library_gate and nx_media_state_gate, found the gv_verdict call sitting unconditionally at the end of main in BOTH: two hits, two false positives. So no count is published for that class at all. ★★★★★★THE DETECTOR ALSO MATCHED ITS OWN NEEDLE -- nx_gate_dry_apply.nx appears in its own suspect list because the tool carries the marker as a template literal, the same self-counting defect the gatelaw census hit. WHAT IS PROVEN AND WHAT IS NOT, STATED SEPARATELY. PROVEN: the defect is real, its rate is 44 of 885, and its manifestation is a COMPILE FAILURE rather than a silent one -- the lost brace and the deleted RED branch happen in the same substitution, so the compiler catches the pair. Measured directly on the banked originals, 42 of the 44 place the gv_verdict call inside a conditional and 2 do not. NOT PROVEN and deliberately unquantified: whether any gate in the compiling population emits nothing on RED. The two candidates I checked by hand say no, and a crude counter is not evidence either way. THE STANDING CONCLUSION IS UNCHANGED AND IS THE REASON THIS WAS CHEAP TO FIND: the compiler refusing is the only reason 42 of these never reached the estate, so the loud half of the defect is what stopped the silent half from shipping.
2026-09-04	LN	land	SECOND REAL DEFECT REPAIRED AND SHIPPED, AND IT IS THE HALF-LANDED-EDIT CLASS CAUGHT IN THE WILD. nx_antipattern_catalog.nx was byte-identical on both trees at 36526, so it was an estate defect and not laptop rot, and it could not compile at all -- meaning a 162-pattern registry plus a mechanical scanner with its own liar-kill controls has been contributing nothing to any green. DIAGNOSIS BY INDENTATION VERSUS COMPUTED BRACE DEPTH, which located it in one pass: divergence begins at line 459 where the author's indentation says depth 1 and the braces say 2. The cause sits at line 458, a comment TRUNCATED MID-WORD reading `SUBMITGATE mode:` followed by a bare backtick and a partial identifier, and the closing brace of the `if argc >= 3` block opened at line 319 was lost together with it. That is precisely the atomicity failure this estate already has a law for -- a multi-part edit over a flaky transport where one part lands and the next does not, leaving an unclosed brace in a live source. REPAIR WAS THE BRACE ONLY. The SUBMITGATE mode was never written and I did not invent it: writing code to a spec I do not have is fabrication, not repair, and the four argv modes above plus the no-arg self-test are untouched. PROVEN BY RUNNING, not by compiling: NX-ANTIPATTERN-CATALOG GREEN with its own controls firing -- dirty control tripped at 11 hits, ghost file scored 0, mmap-in-loop positive control 1 and negative control 0. Shipped to the NAS under compare-and-swap at 37103 bytes from 36526. THE REMAINING FIVE ARE A DELIBERATE QUEUE, NOT AN OVERSIGHT, AND EACH IS TRUNCATED MID-TOKEN WITH ZERO IMPORTERS: abr_t2.nx degenerates into a repeating std_pdec triple and stops mid-identifier on `std`; nx_fbo_s2.nx stops at `let fib1:`; nx_frp_t1.nx references fib3 through fib9 which are never defined and stops at `return`; nx_delivery_report.nx stops at `last_`; and nx_flg_t2.nx is not NishiLang at all -- it is Go or C syntax, `for i := 0; i < len(str); i++` with `
2026-09-04	LN	retract	I WROTE THE LAW THIS MORNING AND THEN BROKE IT MYSELF WITHIN THE HOUR, AND ONLY A SIZE CHECK STOPPED ME SHIPPING ROT INTO THE ESTATE. My own retraction row said, in these words, that 51 rows presented as a fix-list would send the next seat editing sources that are ALREADY CORRECT ON THE NAS and would ship laptop rot INTO the estate under the banner of fixing it. I then took the 6 OTHER-broken rows from my 841-gate compile sweep, diagnosed iv_list as called with 3 arguments where it takes 4, fixed all 5 call sites across nx_estate.nx and nx_pantry.nx, watched all 4 blocked gates go from BROKEN to COMPILES, and was one command from writing it to the NAS. The only thing that caught it was reading the NAS size first: 10226 bytes there against 8032 in my hand. THE NAS COPIES ALREADY PASSED IV_IDCAP AT ALL FIVE SITES. Had I shipped, I would have overwritten 2194 bytes of correct estate work with a stale-derived file, and the compare-and-swap guard would NOT have saved me because I would have supplied the matching expect value myself. ★★★★★★A COMPARE-AND-SWAP TOKEN PROVES NOBODY ELSE CHANGED THE FILE; IT PROVES NOTHING ABOUT WHETHER YOUR OWN CONTENT IS DERIVED FROM THE CURRENT ONE. THE FULL RE-DERIVATION, EVERY ROW PULLED FRESH BEFORE JUDGEMENT: all 7 broken rows in that sweep are laptop-tree artifacts and ZERO are estate defects. Four are the iv_list arity, already correct on the NAS. One is nx_lib_research_alias_gate reporting two definitions of nx_lib_ingest_buf, and on the NAS there is no duplicate at all -- nx_lib_ingest.nx is a COMPLETELY DIFFERENT ORGAN there, a local-file ingest into the research library, because a dedupe on 07-21 already resolved this and nx_lib_http.nx carries a comment saying so. My laptop simply held the stale pre-dedupe copy. One is nx_meta_refresh_gate, which the inbound door answers CG-IO cannot open source on BOTH trees: it does not exist in the estate at all. One is nx_vcodec_dct2_rd_gate, likewise absent. ⚠AND I NEARLY MISJUDGED THE LAST ONE THE SAME WAY TWICE: I renamed a colliding local streq, re-pulled to check, got COMPILES CLEAN and almost called the collision laptop rot -- but the pull had FAILED and I had redirected its output to /dev/null, so I was compiling MY OWN PATCHED FILE and reading it as evidence about the estate. NEVER SUPPRESS THE ERROR CHANNEL ON A CALL WHOSE SILENCE YOU INTEND TO INTERPRET, a law already in this file, broken by me here. WHAT THIS CHANGES: three items I published as owed estate work -- the iv_list arity blocking 4 gates, and two duplicate-definition defects -- DO NOT EXIST. Of 841 dry_apply-migrated gates measured on the laptop, the number broken in the estate is ZERO. WHAT STANDS UNCHANGED, because it was derived the right way: the 7 STILL-ERR rows from the attribution were each tested AFTER a fresh NAS pull, so they are real; 2 are fixed and shipped and 5 remain. ★★★★★★THE DISCIPLINE THAT WORKED IS NOT A RULE, IT IS AN ORDERING: PULL FIRST, THEN DIAGNOSE. Every finding I derived from a laptop file before pulling was wrong, and every finding I derived after pulling was right, with no exceptions in either direction across eleven files today.
2026-09-04	LN	lesson	THE FIVE I QUEUED FOR RETIREMENT MUST NOT BE RETIRED, AND FINDING OUT WHY CHANGED WHAT THE WHOLE UNCLOSED-BRACE CENSUS MEANS. I had them as abandoned generation artifacts with zero importers and proposed reversible retirement. nx_absent over buildroot/runtime, coverage_complete=1 corpus_complete=1, refuted that for one of them immediately: abr_t2 is referenced at nx_forge_rag_ab.nx:117 as ab_leg("rag:T2", "abr_t2", ...) -- a LIVE A/B leg. ⚠MY EARLIER ZERO-IMPORTERS CLAIM CAME FROM A LAPTOP GREP FOR THE QUOTED "abr_t2.nx" AND abr_t2.elf, WHILE THE REAL REFERENCE IS A BARE NAME STRING. A PATTERN KEYED TO THE WRONG VOCABULARY RETURNS A CONFIDENT FALSE ABANDONED, and abandoned is the verdict that authorises deletion. Following the reference settled the class outright: nx_forge_engine.nx:93 does fg_mkpath("runtime/", organ, ".nx", srcpath), so fe_run GENERATES the source at runtime/<organ>.nx, compiles it, and the harness classifies 1=GREEN 2=COMPILE 3=RUN 4=OUTPUT. ★★★★★★THESE ARE NOT ESTATE DEFECTS, THEY ARE BENCHMARK RESULTS, AND THEIR BROKENNESS IS THE MEASUREMENT. abr_t2 failing to compile IS the recorded T2 RAG-arm outcome; deleting it would have destroyed forge data and taken away a subject the next run overwrites. Six generated organs live in runtime/ from that one harness -- abb_t1 abb_t2 abb_t3 abr_t1 abr_t2 abr_t3 -- five compile and abr_t2 does not. Three more match the same shape and are orphaned, no harness naming them: nx_fbo_s2, nx_frp_t1 and nx_flg_t2, the last written in Go/C syntax that could never have compiled in any state, which is precisely what a failed LLM generation looks like. THE ARCHITECTURAL DEFECT, FILED: A GENERATION HARNESS WRITES ITS LLM OUTPUT INTO THE PRODUCTION ORGAN NAMESPACE, SO NO CENSUS CAN TELL AN AUTHORED ORGAN FROM A GENERATED CANDIDATE. The consequence is not tidiness -- it is that the estate's largest compile-refusal class is partly forge output, the headline overstates estate breakage, and the worklist sends the next seat to invent endings for truncated LLM text and commit it to runtime/ as repair. Remedy is a namespace split, generating into knowledge/forge/out/ or similar so every census can partition; until then NO estate compile-refusal figure should be quoted without saying whether forge output was excluded. ⛔I DELIBERATELY DID NOT MOVE THE FILES OR REPOINT THE GENERATOR: that relocates six live benchmark subjects and is the harness owner's call, and absence from buildroot/knowledge is UNPROVEN -- nx_absent returned corpus_complete=0 truncated=1 over that tree, so I cannot claim nothing else references them by path. ★★★★★★AN ABSENCE PROOF THAT DECLARES ITS OWN INCOMPLETENESS IS THE ONLY REASON THIS ENDED IN A FILING RATHER THAN A DELETION.
2026-09-04	LN	land	THE BUS STOP: THE DIVERGENCE GAUGE WAS NEVER DARK, IT WAS LIT AND UNREAD, SO THE FIX WAS TO MOVE ITS VERDICT ONTO THE SURFACE NOBODY CAN SKIP. Before building anything I ran the prescribed pre-flight, and it paid for itself immediately: nx_capsearch over 7348 entries with corpus_complete=1 returned nx_treediff at rank 1, scoring 520648, described in its own words as making laptop-SSOT versus NAS-buildroot drift A REPORT NOT ARCHAEOLOGY, with nx_treediverge_beat beside it as the standing daily gauge and nx_hashdiverge as the content-exact comparer. ★★★★★★I WAS ONE COMMAND FROM BUILDING A FOURTH COPY OF AN INSTRUMENT THE ESTATE ALREADY HAD THREE OF -- I DIDN'T KNOW IT EXISTED IS A RETRIEVAL FAILURE, NOT A DISCOVERY. Then the measurement that reframed the whole session: the beat is ALIVE, firing every roughly fifty minutes, and its latest line published divergent=3387, partition RECONCILES, verdict BIDIRECTIONAL -- NEITHER TREE IS A SUPERSET, a one-way sync in either direction DESTROYS WORK, merge per-file never push wholesale. That is precisely the fact whose absence cost me eleven hand-diagnosed files and a near-miss overwrite of 2194 bytes of correct estate work. THE GAUGE WAS FRESH, CORRECT, AND NOBODY READ IT. A second standing alarm rides the same line and is equally unread: SRCGUARD rc=4 WORK LOST, nine top-level symbols GONE from canonical sources across nx_schema_backfill, nx_softbind and nx_treehash, with the verdict DO NOT DEPLOY FROM THIS TREE, unchanged across every run in the window. WHERE THE GAP ACTUALLY WAS, measured not guessed: pulse.txt is emitted verbatim as the SessionStart additionalContext, so its first line is the first estate fact any seat sees -- and it had not been rewritten since 2026-08-06, TWENTY-NINE DAYS, while still advertising health_index=500 permil as though current. ★★★★★★A STALE HEADER IS WORSE THAN AN ABSENT ONE: AN ABSENT LINE PROMPTS A QUESTION, A MONTH-OLD LINE PRESENTED WITHOUT ITS AGE IS SIMPLY BELIEVED. SHIPPED: nx_pulse_emit, a laptop-local organ that reads the trend line from a LOCAL file (SessionStart must work offline; a guard that needs the backend is absent exactly when a saturated backend is making you impatient), judges it, and REPLACES the stale header while preserving every remaining byte. It replaces rather than prepends because the channel delivers about 2000 bytes and the file already measured 1977 -- prepending would have silently evicted the LIVE LAWS at the tail, the same cliff MEMORY.md pays for. BITE-PROVEN IN BOTH REFUSAL DIRECTIONS, not merely observed passing: over-cap REFUSES at exit 1 with the fixture byte-identical at 2378 afterwards, and an unreadable trend line ABSTAINS at exit 3 leaving the header standing rather than acquitting. ⚠MY FIRST OVER-CAP FIXTURE WAS VACUOUS -- a tr -dc pipeline yielded 460 bytes instead of 1900 so the condition was never reached and the organ correctly WROTE; I caught it only because I asserted the fixture size before believing the outcome. WIRED, because a refresh mechanism that itself goes stale IS the defect it was built to fix: roster row pulse at 3600s in stoproster.json, ten entries, all nine priors preserved, driven by a wire-only pulserefresh.ps1 that fetches and decides nothing. Proven end to end through the roster path, idempotent at 1986 bytes twice, tail byte-identical to the banked original. ⚠TWO LANDMINES HIT AND FIXED IN THE WIRING: the Git Bash chmod reported the installed elf as -rw-r--r-- while WSL, which is what actually execs it, reported -rwxrwxrwx -- MODE IS A VIEW, EXECUTION IS THE PROOF, so I proved it by running the binary; and PowerShell's Set-Content -Encoding utf8 wrote a BOM into the trend-line data file, harmless to a key-anchored search but a latent trap for any positional reader, replaced with a no-BOM writer and re-verified.
2026-09-04	LN	retract	THE SECOND STANDING ALARM IS A FALSE POSITIVE, AND I AMPLIFIED IT TO EVERY SEAT BEFORE I MEASURED IT. An hour ago I put srcguard's own words -- WORK LOST, DO NOT deploy from this tree -- onto pulse.txt, the SessionStart line every seat reads FIRST, on the strength of it being fresh and unread. Then I pulled all three flagged files from the NAS and read them, and ALL NINE reported-lost symbols are DELIBERATE, DOCUMENTED REMOVALS whose justification sits within a few lines of where the symbol used to be. nx_schema_backfill.nx:53 says in plain words that SB_SRCCAP and the private sb_has scanner "were DELETED 2026-08-25, not merely bypassed". nx_treehash.nx:285 carries th_ends_nx only in prose describing the walker's scope. nx_softbind.nx:30 and 63 and 125-128 remove the six SB__CHEST constants because "CHEST IS NOT A ROW HERE. It is derived from the oracle bands below", calling the old table "exactly the duplicate-ruler defect this file already retired once", with an arithmetic-equivalence claim beside it. TRUE POSITIVES ON THE LIVE POPULATION: ZERO OF NINE. ⚠MY FIRST CHECK WAS ALSO THE WRONG ONE AND NEARLY GAVE ME A FALSE REFUTATION IN THE OTHER DIRECTION: I grepped for the symbol names and read three as PRESENT, but a grep counts MENTIONS while srcguard tracks DEFINITIONS -- all three "present" hits were comments. srcguard is RIGHT that the symbols are gone and WRONG about what that means, and only reading the lines separates those two. THE HISTORY IS THE FINDING. Debt 1785445449 records that srcguard v1 ruled on BYTES, fired wrong both times on its first day, and was corrected because -- its own author's words -- "a shrink is not a revert; dead code deletion, comment tightening and dedup all shrink a file while the tree gets better, and A GUARD THAT CALLS THAT DESTRUCTION TRAINS EVERYONE TO IGNORE IT." v2 moved to symbol-set containment. ★★★★★★THAT SENTENCE NOW DESCRIBES v2 WORD FOR WORD: A DELIBERATE REMOVAL IS NOT A REVERT EITHER, AND THE FIX FOR A FALSE-POSITIVE RULER REPRODUCED THE SAME DEFECT ONE LEVEL DOWN. With 1785521381, which found the same detector structurally blind to intra-function corruption because the 0x0E event changed zero top-level symbols, this instrument has now been measured wrong in THREE INDEPENDENT DIRECTIONS ACROSS THREE FILINGS -- a recurrence rate, not three mistakes. Filed as a supersede. ⚠AND THE PROPAGATION LESSON IS THE ONE I PAID FOR: RELAYING A DETECTOR'S VERDICT VERBATIM INHERITS ITS FALSE POSITIVES AND CARRIES THEM TO ITS WIDEST AUDIENCE. The boot line now reads srcguard=ADVISORY (cannot tell refactor from revert) instead of an unqualified deploy prohibition, because a permanently-red alarm on the estate's most-read surface would have taught every seat to skip the whole line -- including the divergence figure beside it, which is TRUE and is the reason the line exists. ⛔WHAT I DID NOT DO, DELIBERATELY: I did not ship a fourth ruler. The obvious mechanical discriminator -- does the removed symbol's exact name still appear in the file's prose -- separates only 3 of the 9, because nx_softbind explains its six removals conceptually without naming them, so it is a NOISE REDUCER AND NOT A SOLUTION and shipping it as one would be the fourth wrong ruler in this detector's history. The discriminator that worked was reading the source. Saying that plainly is better than automating a guess.
2026-09-04	LN	measure	THE ESTATE COMPILE-REFUSAL COUNT IS ANSWERED WITHOUT THE ARRAY, AND THE HARDWARE BLOCKER WAS REAL FOR THE METHOD I CHOSE AND NOT FOR THE QUESTION I ASKED. I had recorded this as owed until the RAID recovers, because a whole-corpus NAS compile sweep would route hours of I/O around the very governor protecting degraded disks. That is true of a SWEEP. It is not true of the QUESTION. The estate already publishes knowledge/status/treecanon_nas_hash.mf, 19442 sha256 rows, so joining the laptop census against it answers per-file identity at ZERO array cost -- one 1.8 MB fetch instead of 19442 compiles. ★★★★★★A BLOCKER ATTACHES TO A METHOD, NOT TO A QUESTION -- ASK WHAT ELSE ALREADY MEASURES THE THING BEFORE ACCEPTING THAT IT CANNOT BE MEASURED. FOUR CORRECTIONS BEFORE THE NUMBER WAS HONEST, each caught by a control rather than by care. (1) The first join returned 400 of 400 NAS-ABSENT, the uniform-failure tell again: the manifest is rooted AT runtime/, so every census path needed that prefix stripped. Proven by abr_t2.nx, whose manifest sha equals the sha the content-get lane returned on pull. (2) The join then measured MY OWN REPAIRS -- the census errors were recorded before I pulled 51 NAS copies over their laptop twins, so IDENTICAL meant identical NOW. Same self-re-baselining as the migsweep, second time in one session. (3) ★★★★★★THE DEEPEST ONE: IDENTITY OF THE ERRORING FILE IS NOT IDENTITY OF ITS CLOSURE. nx_persona_gate.nx is byte-identical to the estate and STILL failed here, because nx_persona.nx, which it IMPORTS, was stale on the laptop. Requiring the whole transitive closure to be identical -- resolving imports the way the builder does, _hdl_build/ first then runtime/ -- took the claim from 284 to 139. A leaf-identity proof cannot carry a closure-level claim. (4) The contamination exclusion was then over-broad in the other direction: it listed nx_syscalls.nx, which nearly every file imports and which the pull returned SAME at 99746 bytes both sides. A PULL THAT CHANGED NOTHING CANNOT CONTAMINATE ANYTHING, so the exclusion had to be narrowed from files-I-pulled to files-I-actually-CHANGED, decided by hashing the banked pre-pull originals. FINAL, AND THE PARTITION RECONCILES AT 284: closure-proven and uncontaminated 135, closure-divergent UNPROVEN 119, excluded because the closure holds a file I changed 30. So the estate carries 135 PROVEN compile refusals from this census, with 119 more that need a pull each before anything may be said about them. THE OUTPUT IS A RANKED CAUSAL WORKLIST, NOT A COUNT, and two causes were worked to zero immediately. FIRST: nx_ts_verdict_is_valid defined in BOTH nx_token_sample.nx and nx_transformer_stack.nx -- a PREFIX collision, nx_ts_ claimed by token_sample and transformer_stack alike, three symbols colliding (NX_TS_OK, NX_TS_N_VERDICTS, nx_ts_verdict_is_valid) and NX_TS_N_VERDICTS holds DIFFERENT VALUES, 5 against 6, so merging them would have been wrong. Measured before touching: ZERO of the 17 blocked programs reference any colliding symbol -- they merely import both modules, so the collision lives in the closure and no caller needed changing. NX_TS_OK is 0 on both sides, so the one ambiguous consumer, nx_llm_run_v2.nx which imports both, is unaffected by which it binds. Renamed the transformer_stack side to NX_TXS_/nx_txs_ plus its test: 17 OF 17 UNBLOCKED BY ONE RENAME, both files shipped under CAS. SECOND: five gates each carried a private g_check beside the one nx_gate_emit_lib.nx already provides -- the duplicate-ruler defect that was ALSO a compile error, so nx_codec_provenance_gate and the four roku gates had never built at all. Deleted the local copies; all five compile, and they RUN: codec_provenance GREEN, the four roku gates RED with bytes=0 because their catalog.json fixture does not exist on this laptop, so THE RED IS UNADJUDICATED AND I AM NOT CLAIMING IT EITHER WAY until they run where the fixture lives. ⚠A REAL SECONDARY DEFECT FELL OUT OF THAT RUN: roku R9, named LIAR-KILL: no personal reference, PASSES ON A ZERO-BYTE FILE -- a control that cannot fail on empty input is the tooth-that-passes-on-the-empty-set defect, sitting inside the very row that exists to be the liar-kill. ⚠And one write of the five returned NO JOB ID and had NOT landed; the artifact said so, the receipt did not.
2026-09-04	LN	lesson	THE WORKLIST CONTAINED ROWS WHERE FIXING THEM IS THE DEFECT, AND THAT IS THE MOST DANGEROUS THING A COMPILE-REFUSAL LIST CAN CARRY. Working down the ranked causes I reached expand_imports failed at n=12 and read the files instead of the counts. Two of them say what they are in their own headers. nx_hdlimp_neg_probe.nx: "NEGATIVE control for the resolver fix -- imports a module that exists NOWHERE in the tree. MUST fail expand_imports before AND after the fix; IF THIS EVER BUILDS, THE RESOLVER HAS GONE FAIL-OPEN AND THE FIX IS REFUTED." nx_badimport_probe.nx: "FAIL-OPEN PROBE -- an UNRESOLVED import must be a LOUD ERROR", filed because nx_cc once emitted an EMPTY elf on an unresolved import and three real organs "built successfully" and produced nothing. ★★★★★★A PROGRAM WHOSE PURPOSE IS TO FAIL TO COMPILE IS A PASSING TEST, NOT A DEFECT -- AND A SEAT WHO TOOK MY WORKLIST AND MADE IT BUILD WOULD HAVE DELETED THE CONTROL THAT PROVES THE RESOLVER IS NOT FAIL-OPEN. Same family as the forge outputs found earlier today: in both cases a refusal IS the recorded measurement, and the census cannot see the difference. SEPARATED BY THE FIXTURES' OWN VOCABULARY, never by a name pattern I invented -- NEGATIVE control, MUST fail, FAIL-OPEN, must be a LOUD ERROR, if this ever builds: 7 of 135 are deliberate negative fixtures, 128 remain as candidate defects, and the partition reconciles at 135. ⚠THE 7 IS A FLOOR AND I AM LABELLING IT ONE. z.nx imports "z", and _nxiq_conflict.nx double-imports the same module under two names while _nxiq_noexport and _nxiq_unkns are named for the exact compiler conditions they exercise -- all four are plainly fixtures and NONE carries a marker phrase, so a vocabulary-keyed detector cannot see them. That is the same blindness this estate already recorded: a marker list keyed on the vocabulary of the thing you are detecting cannot see instances expressed in other vocabulary, and the miss reads as "this does not exist" rather than as "my definition is too narrow". ⇒ THE STRUCTURAL REMEDY IS A DECLARATION, NOT A CLEVERER PATTERN: a fixture that must not compile should SAY SO in a machine-readable field the way organ_kind.conf and organ_gate.conf already resolve kind and gate ownership by declaration rather than by name -- the estate reached that conclusion twice before, from the classifier side and from the gate side, and this is the third arrival. Until such a field exists, EVERY compile-refusal worklist must be read by a human before a single row is actioned, and that instruction now travels with the list. ⇒ Worklist written to knowledge-adjacent banks: estate_defects_worklist.txt (128 rows, ranked by cause) and estate_negative_fixtures.txt (the 7 that must stay red). ⚠5 of the 128 are the g_check duplicates already fixed and shipped this session, so the live figure is 123 and the file predates that fix.
2026-09-04	LN	land	THE SOTA MEASUREMENT I HAD BEEN DEFERRING IS LANDED AS COMPARE DATA, AND THE REASON FOR DEFERRING IT HAD EXPIRED. I said earlier today that I would not draw a SOTA comparison through instruments I had just found wrong -- a census overstating estate breakage, a detector at a 100 percent false-positive rate, and a boot surface 29 days stale. That was right when I said it and wrong to keep saying: all three were repaired or characterised in this session, so the justification no longer held. ⚠A DEFERRAL IS ONLY HONEST WHILE ITS PRECONDITION IS STILL TRUE, AND A SEAT THAT REPAIRS THE PRECONDITION MUST GO BACK AND LIFT ITS OWN DEFERRAL RATHER THAN RE-QUOTE IT. WHAT LANDED, in the shape the standing order defines and the shape /compare/browser already ships: a MEASUREMENT AND ITERATION TOOLING section in lang.matrix, 8 rows, every one mapping a real instrument of the compiler field to either an estate organ that EXISTS or a named _ABSENT_ watch. Verified before writing, not after: nx_langcensus, nx_cc_equiv_gate, nx_gate_bite, nx_lang_h2h, nx_srclint and nx_unwired all exist with the symbols named, so the generator will re-measure each on every beat and no cell can rot into a claim. Rows cover the whole-corpus compile census against crater-class ecosystem rebuilds, self-validation against multi-stage bootstrap plus equivalence-modulo-inputs fuzzing [emi2014], mutation testing over the gate fleet, benchmark receipts with a declared control [stabilizer2013], diagnostics against the bar Elm set for errors addressed to a person [elm-errors], expect-fail declaration against rustc compiletest and GCC dg-error and Go errorcheck, and the dead-code census against Go's unused-variable error and Rust's dead_code lint. Only ref keys that ALREADY RESOLVE were cited -- an unresolvable mark turns the refs gate RED, so inventing a citation to dress a row would have broken the very referee that makes the section trustworthy. THREE BUILD CONTRACTS, EACH WITH ITS DONE-RULE PRE-DECLARED BEFORE THE ORGAN EXISTS, admitted as rungs LN47, LN48 and LN49 under a new milestone M6 with ver 4.0 so the ranker prices them: closure-identity scoping (done when the organ reproduces today's 135/119/30 partition AND a planted stale import demotes a PROVEN row -- the second clause is the anti-vacuity tooth, since a scoper that never demotes has not been shown to fire); expect-fail declaration (done when it catches at least one fixture the vocabulary scan MISSED, because reproducing the floor adds nothing); and diagnostic grading (done when a deliberately regressed diagnostic LOWERS the score, so it carries its own negative control). ★★★★★★THE ONLY EXCEED CLAIMED IS THE ONE THE FIELD STRUCTURALLY CANNOT HAVE: no mainstream toolchain scopes a refusal figure by transitive-closure identity across two trees, because they build ONE tree and have never needed to. Everything else is coded PARITY or worse, including mutation testing, where the honest reading is a stronger tool at unproven coverage rather than an exceed. Sizes verified by prediction on both appends -- matrix 87125 to 92922 which is exactly the 5797-byte section, plan 166790 to 169497 which is exactly the 2707-byte rung block -- after an earlier append in this session DOUBLE-APPLIED and was caught only because the delta matched neither one nor two times the new row.
2026-09-04	LN	land	THE EVIDENCE REFEREE WAS RED ON A FALSE POSITIVE, AND THE CAUSE WAS A ONE-BYTE FORMAT TEST. Running nx_compare_refs_gate to check my own compare-data change came back 23/24 RED. My change was clean -- cite-marks-resolve-every-one PASS, marks=3281 unresolved=0, uncited_keys=0, so the section I had just landed broke nothing -- but the gate carried a live failure I had not caused: mirror-incompleteness-ratchet-does-not-rise FAIL, incomplete=1 against a baseline of 0. ★THE GATE HANDED ME ITS OWN WORKLIST rather than a bare count, which is the whole reason it was actionable in one step: knowledge/status/refs_mirror_incomplete.txt named exactly one row, procgen key fastnoise2, mirror rf_51393572.raw, reason json-unterminated, size 6339. THE DIAGNOSIS, from the bytes and the declared url, not from the verdict: the mirror is a GitHub README.md that opens with a badge, "[![GitHub Actions CI](...)](...)", and its first two bytes are 5b 21 -- an opening bracket followed by a bang. mi_classify tested exactly ONE byte: first non-space byte is { or [ means JSON. So it read a markdown document as a JSON array, found that the array never closes, and published json-unterminated against a file that is COMPLETE. ★★★★★★A FORMAT CLASSIFIER THAT KEYS ON THE FIRST BYTE MISREADS EVERY MARKDOWN DOCUMENT OPENING WITH A LINK OR A BADGE -- AND ON GITHUB THAT IS THE NORM, NOT AN EDGE CASE, so the false-positive population is every README mirror we hold. THE FIX IS TWO BYTES WIDE AND CANNOT MISJUDGE REAL JSON: after the opening bracket the next non-space byte must be able to START a value -- quote, brace, bracket, closing bracket, minus, digit, t, f or n. A bang is none of them. No valid JSON can fail that test, so the check is wrong only in the direction of DECLINING TO JUDGE. PROVEN BOTH WAYS ON THE REAL FILE, not on a planted fixture: pre-fix the classifier returns class=1 SUSPECT rcode=5 json-unterminated, post-fix it returns class=3 UNKNOWN rcode=9 no-format-signature-cannot-judge. ★IT ABSTAINS RATHER THAN ACCUSING, AND IT DOES NOT SWING TO THE OPPOSITE LIE EITHER -- it does not claim COMPLETE, because it cannot verify markdown completeness, and an instrument that cannot see must say so rather than acquit. AND THE DETECTOR STILL BITES: nx_mirrorintegrity_gate ran 15/15 GREEN with json-unterminated BITE-PROVEN (fires on bad, silent on good), so genuinely truncated JSON is still caught -- a fix that quiets a false positive by disabling the detector would have been worse than the false positive. ⚠THIS IS THE SECOND MEASURED FALSE-POSITIVE CLASS IN THIS ONE INSTRUMENT: the first was a 941-per-thousand rate on structural completeness, root-fixed after controlling all 17 cited files of a class. A detector bite-proven on PLANTED fixtures is not calibrated on REAL data, and both times the real data was where it broke. ⚠And a self-inflicted trap for the fourth time in this session: the probe read bytes=0 unreadable because I wrote its fixture from Git Bash into a /tmp that WSL cannot see -- the same filesystem split that cost three earlier runs, repeated after I had already journalled it twice. ★I removed the probe from runtime/ when I was done: leaving scratch in the production organ namespace is exactly the defect I filed against the forge four hours ago, and writing the row does not exempt the author.
2026-09-04	LN	land	CLOSED END TO END: THE ESTATE'S EVIDENCE REFEREE IS 24/24 GREEN, AND THE SOURCE FIX WAS ONLY HALF THE WORK. Shipping nx_mirrorintegrity_lib.nx would have left the fix BUILT-AND-UNSHIPPED -- the exact class this session has been documenting all day, where a written and compiled correction is byte-indistinguishable from a bug nobody found. The gate COMPOSES the classifier in-process, so the fix reaches nothing until the gate binary itself is rebuilt. Full chain, every step verified by artifact rather than receipt: /api/build returned BUILT 90400 bytes with src_path naming buildroot/runtime/nx_compare_refs_gate.nx -- READ ON EVERY BUILD, because expect_sha256 proves the staged bytes are the ones just built and says NOTHING about whether the right source was compiled; /api/promote with expect_sha256 returned PROMOTED at that identical sha 3879f57b with prev banked; and the re-run moved the board. THE MEASURED MOVEMENT, and the partition holds at 1275 across it: truncated_suspect 1 to 0, unknown 140 to 141, incomplete 1 to 0, so mirror-incompleteness-ratchet-does-not-rise went FAIL to PASS and the gate went 23/24 RED to 24/24 GREEN. ★THE ROW MOVED SUSPECT TO UNKNOWN, NOT SUSPECT TO COMPLETE, exactly as the pre-ship probe predicted -- the classifier declines to judge a markdown body rather than swinging to the opposite lie, and unknown rising by exactly one is the receipt that the change did what it claimed and nothing else. ⚠THE GATE'S OWN RESIDUAL IS PUBLISHED IN ITS VERDICT AND I AM NOT PAPERING OVER IT: fetch-time provenance proves the mirror is OF the url, never that the mirror SUPPORTS the claim -- 587 of 1275 mirrors remain provenance-unproven, that is a declared human read, and no tooth on this gate measures it. GREEN here means the citations register is well-formed and its mirrors are whole; it does not mean the claims are true.
2026-09-04	LN47	measure	THE COMPARE BOARD'S OWN PUBLISHER WAS STALE FOR OVER THREE HOURS, AND ADJUDICATING THE RESTAGE IS THE SAME DISCRIMINATION PROBLEM THIS RUNG EXISTS FOR. compare_forkfresh.status read ts=1788536768, more than 3.3 hours old, with FORK-STALE nx_swcompare_matrix -- the generator whose CWD fix I had deployed as SOURCE earlier today without rebuilding its buildroot/_offc twin, so every matrix page including the measurement section I had just landed would have published through the old binary. That is the third-twin defect CLAUDE.md records as having cost four seats the same investigation, recurring in my own lane the same day I read it. nx_restage through nx_job_run returned RESTAGED 328449 bytes. THEN THE QUESTION: the promoted binary is 357136 bytes, sha a76b4271, and the fresh fork is 328449, sha d460aa13 -- 28687 bytes SMALLER after an addition, which the standing law reads as a REVERT. A SIZE DELTA IS A QUESTION, NOT A VERDICT, so the content ruler decided it, and its answer was honest about its own limits: lost_from_live=268 partitioned srcpath=19 symbolname=245 sectname=3 other=1, summing to 268; symmetry=BIDIRECTIONAL with 13 runs GAINED; and its own text naming the cause -- most of the loss is compiler-embedded source paths and symbol names, which is what -g adds, a debug and a release build of the same source differing by about 184 permil -- against a measured 180 permil here. The single lost_other, the string RED (a check failed), reappears in the GAINED list with a colon appended: RE-ENCODED, not lost. And the GAINED list carries my own CWD-fix refusal text, .matrix absent from BOTH, plus REGISTRY-MISPOINTED and neg-control-nonzero -- new capability, present in the fork and absent from the promoted binary. ★★★★★★THE FORK IS AHEAD OF THE PROMOTED BINARY AND IN RELEASE FLAVOUR; THE RED IS A FLAVOUR ARTIFACT THE RULER ITSELF PREDICTS, AND THE PROMOTED BINARY IS THE STALE ONE. The regen was launched through it. ⚠WHAT IS OWED AND WHY IT IS THIS RUNG'S BUSINESS: leaf-versus-closure identity and debug-versus-release flavour are the same failure -- a byte comparison whose SUBJECT is wider or narrower than the thing it claims to judge. The ruler's own prescribed control, rebuild the candidate with --debug and re-run, which took nx_hostctl from 332 lost to 2, was NOT run here because the array is degraded and the partition plus the bidirectional symmetry plus the re-encoded lost_other decided it; that control is the definitive one and stays owed. And the promoted binary should be re-promoted from current source so promoted equals fork equals source -- three roots means three checks, and today two of the three disagreed.
2026-09-04	LN47	land	THE COMPARE GENERATOR'S THREE ROOTS AGREE, AND THE LANE-VARIANCE CLASS IS NOW CLOSED THE WAY THE RECORD SAYS TO CLOSE IT. Sequence, each step verified by artifact: /api/build from current source returned BUILT 363888 bytes sha 2b7f4e0c with src_path naming nx_swcompare_matrix.nx and a banked prior stage from another seat; the same-lane content ruler read lost_from_live=2 at 1 permil -- cl_regorgan, a dead symbol name, and RED (a check failed), which reappears in GAINED with its failing conjunct now appended, a re-encoding that is an improvement -- with 27 runs gained including my own CWD-fix refusal text; /api/promote at that sha returned PROMOTED with prev banked. THEN THE STRUCTURAL FACT: a second nx_restage rebuilt the buildroot/_offc fork at 328449 bytes, the same size as the first, because the restage lane and the api/build lane produce different bytes from IDENTICAL source, 9.7 percent apart and inside the measured 6 to 17 percent band. A rebuilt fork can therefore NEVER read FRESH against a promote from the other lane, by construction, and the regen's freshness check was reading that permanent mismatch as staleness. ★★★★★★WHEN TWO LANES CANNOT PRODUCE THE SAME BYTES, FRESHNESS MUST BE ESTABLISHED BY COPY, NOT BY REBUILD -- and the record already said so: nx_filecopy promoted into buildroot/_offc with overwrite, mode preserved. NX-FILECOPY OK bytes=363888 verified=1, destination re-read and compared byte-for-byte, mode_preserved=493. Promoted, fork and source now agree, and the next regen's forkfresh line is the receipt that will show it. The debug-flavour control the ruler prescribes was made unnecessary for this target by the copy, but it stays owed as the general instrument for any target that must be rebuilt rather than copied.
2026-09-04	LN41	queue	A FRONT-END FIX LANDED IN SOURCE BY A LANE THAT DIED BEFORE REPORTING IT, FOUND BY A 4147-BYTE PARSER DIVERGENCE DURING A SHIP (2026-09-04). runtime/nx_parse.nx 433947 -> 438094 B: (1) lookup_enum_type -- a PLAIN enum name (no payload) used in a TYPE position resolves, where before it died as I do not know a type named X; a tagged enum already resolved through its shadow struct, so only payload-free enums were value namespaces that could not be NAMED in a signature, and Result<i64, NetError> did not compile -- measured on runtime/nx_net.nx (8 errors) and runtime/fs.nx (10). (2) A CODEGEN DEFECT in the variant constructor: it returned the alloca id, which is a SLOT, and every as-VALUE consumer dereferences a slot, so return Result::Ok(v) compiled to a load of the shadow's first word and returned the TAG -- Ok(x) came back as 0, indistinguishable from null, Err(x) as 1, a bogus non-null pointer; fixed by emitting a GEP at offset 0 AFTER the stores so the caller receives a materialised address, the sibling half of the bug already fixed in x86ctx_emit_gep. STATUS, MEASURED BY THE SEAT: the fix lives in the parser SOURCE that library-importing organs compile in (nx_wgsl rung 2 links nx_parse and reads 105/105 and 39/39 with it), but the INSTALLED TOOLCHAIN is a prebuilt binary that does not carry it -- nx_net still refuses with 10 errors on the laptop, and nx_cdp_eval, rewritten by the same lane to compose nx_net, is therefore currently UNBUILDABLE. ⇒ UNPROVEN FOR ITS PURPOSE until the toolchain is rebuilt from this parser through the sanctioned lane (nx_cc_equiv_gate 10/10 + self-host GREEN + canary), which the laptop-farm lane must never do. The parser SOURCE is shipped to the NAS under CAS so that source and the nx_wgsl binary agree (a served binary carrying code its source cannot rebuild is the AHEAD class). ACCEPT RULE for the toolchain rung: nx_net compiles clean, a KAT proves Result::Ok(v) returns a pointer whose first word is the tag and not the tag itself, and nx_cdp_eval builds and passes its refusal paths and round trip.
2026-09-04	LN47	land	THE EVIDENCE REFEREE HAD A FIXED READ WINDOW ON ITS OWN PROVENANCE JOURNAL, MY ADMISSIONS CROSSED IT, AND THE GATE ABSTAINED HONESTLY INSTEAD OF ACQUITTING -- WHICH IS THE ONLY REASON THE DEFECT WAS FOUND THE SAME HOUR. Third refs-gate run of the day read 22/24 RED with every substantive tooth passing -- pins matched 1351 of 1351, unresolved 0, uncited 0, incomplete 0 -- and its first line naming its own blindness: PROV-JOURNAL-TRUNCATED, the journal filled this reader's window, so the provenance verdict is UNOBSERVABLE. The two failing teeth were the truncation abstain and the unproven ratchet RISING by 29 -- and all 29 named rows were mine, the LLM and browser mirrors admitted minutes earlier, each of which the fetch lane HAD journalled: they were in the file, past the window, and a reader that cannot see a row cannot count it proven. CAUSE, from the source: CRG_CAP = 262144, ONE constant shared by NINE unrelated reads in the gate, and the journal reached 1306 rows. ★★★★★★A CAP IS NOT A NUMBER TO TUNE, AND ONE CONSTANT SERVING NINE PURPOSES CAN NEVER BE TUNED FOR ANY OF THEM. Fixed the way the record prescribes: the journal read composes sys_read_file, which sizes its buffer from the file and cannot short-read, so the TRUNCATED state is retired by construction and the observed-not-absent-not-truncated tooth keeps only its honest half -- an absent journal still fails it, because sys_read_file returns null on absent and prows stays 0. No other read in the file was touched: the eight siblings each get their own decision, not a widened constant. Shipped under compare-and-swap at 49123 bytes from 47565, built at 92080 bytes sha 6fb249b1 with src_path verified, promoted at that sha with prev banked, and RE-RUN: 24/24 GREEN, jrnl_rows 1306 to 1335 -- exactly the 29 rows the old window hid -- proven 738 to 767, unproven 616 back to the baseline 587 to the row, the truncation line gone. ★THE MOVEMENT IS THE PROOF: a reader that gained precisely the rows it was previously blind to, and a ratchet that fell by precisely that count, is a fix whose effect was predicted before it ran. ⚠THE OTHER EIGHT CRG_CAP READS ARE NOW A NAMED WORKLIST, NOT A FIXED PROBLEM: each register, matrix, plan and sota read in this gate still wears the same constant, and any of them crosses 256 KB the day a board grows enough -- browser.matrix is already 107 rows. Each should compose sys_read_file on its own merits; I fixed the one that was measured broken and named the rest rather than sweeping them blind.
2026-09-04	LN50	land	September 2026 compiler and toolchain SOTA admitted as DATA from the adversarially verified sweep (workflow wf_d98197e2-d2e): 20 refs pinned by fetch receipt (lang.refs 18143 to 27986 B), a section of 15 rows with 13 watch contracts and 2 met-bar rows (lang.matrix 92922 to 101456 B), rungs LN50-LN59 under M7 ver 5.0 (lang.plan 187305 to 191267 B); every append settled by predicted size and proven single by row-unique count on the tail
2026-09-04	LN50	measure	referee nx_compare_refs_gate 24/24 GREEN fleet-wide (job 1788561456): files=103 rows=1454 pins=1390 matched=1390 marks=3530 uncited=0 unresolved=0 provenance proven=806 mismatch=0 unproven=587 unchanged. Sweep attrition: 24 findings, CONFIRMED 17, ALREADY-COMMON 3 (schema validation, Fedora mass rebuild, lit expect-fail vocabulary), REFUTED 2 (ClozeMaster bug count, Alive2 daily dashboard), UNDATED 1 (SARIF 2.2), UNCITABLE 1 (diverse double-compiling in practice); only CONFIRMED items carry watches, the others are bars
2026-09-04	LN54	retract	the first referee run read 23/24 RED on provenance-mirror-url-never-contradicted: the brack row carried a hand-typed URL (Verified-Scheme-Compiler) while the fetch journal holds the URL the mirror was actually taken from (Verified-Compiler-for-Scheme). Corrected in place by one whole-file CAS write; re-run 24/24. The claim was never wrong, the address was
2026-09-04	LN54	lesson	the fetch RECEIPT is the row: it carries the saved path, the sha256 and the URL that was fetched, so a ref row is composed FROM the receipt, never from a URL typed by hand or matched by prefix. The provenance tooth exists for exactly this and it fired on the first try; a receipt-composed row cannot contradict its own journal
2026-09-04	LN52	queue	build order from the cross-domain rank, cheapest proof first: LN52 known-bug id and XPASS (SMALL, on nx_langcensus beside LN48), LN56 schema-validated diagnostics with SKIP, LN55 two-axis peephole harness, then LN50 and LN51 together (object model then snapshot corpus), LN53 rebuild partition, LN54 per-pass certificates (MEDIUM, the credible-compilation rung the field measures at a tenth of full verification), LN57-LN59 behind their named prerequisites; the masked vectoriser and the seed SBOM chain are LARGE watches, third tier
2026-09-05	LN16	measure	an instance of the unchecked-lane crash class found by using the estate as a user, 2026-09-05: nx_goalmap_lib indexes sys_mmap raw arrays sized by guessed caps (GM_MAXWORDS 24, GM_MAXRUNG 512, GM_MAXMAT 512, GM_MAXDOM 16, GM_OUTCAP 16384 which was already raised once from 8192) and the promoted binary SIGSEGVs at 0x401e23 on an 8-board 16-word query while silently DROPPING words past 24 on another; the crash guard itself names the remedy (fixed arrays and slices refuse out-of-bounds with a message); debt 1788626163, engineshift ES21 owns the organ -- the fleet instrument owed here is a census of organs that size raw arrays from a const cap and index them from user input, so this class is counted rather than rediscovered one crash at a time
2026-09-06	LN60	queue	FLAGGED from the gameengine lane (GE59, the cast fragment transcription), which lands only the compiler half here and does not take the census or the research: the compiler fix is three anchored edits on nx_parse.nx (NX_PARSE_GLOBALS_SLACK named; count_global_tokens beside count_func_tokens; parse_module sizes globals_cap from it) and a message-fidelity fix owed in nx_ir.nx, whose three identical ir_add_global_* refusals say `raise the derivation in ir_module_new` -- a hand-copied paraphrase that names the wrong site (parse_module is the allocator for every compiled unit; ir_module_new serves hand-built test modules) and cost one seat the first look. Ship path: /api/build or nx_sov_build_run nx_compile_x86 + nxasm_x86_main (the sibling LN42 assembler change rides along, matched pair), nx_stage_alias to nx_cc_sovereign.elf.new and nxasm_x86_main.elf.new, /api/promote_toolchain each (canary + .prev bank + auto-rollback), then rebuild the consumer. The estate-wide half (every domain's declared numbers) is CQ13 on codequality
2026-09-06	LN60	land	THE COMPILER HALF IS LIVE: nx_parse.nx count_global_tokens (TK_STRING + TK_STATIC + TK_FLOAT + TK_FLOAT_F32 + TK_FUNC) + NX_PARSE_GLOBALS_SLACK=256 replace the declared NX_PARSE_GLOBALS_CAP=4096 in parse_module (three anchored CAS edits, 438094 -> 440388 B); nx_ir.nx's three ir_add_global_* refusals now name parse_module as the derivation site (message fidelity; nx_ir.nx is CRLF, so every cross-line anchor needs a carriage return). nx_compile_x86 built through /api/build (973080 B, sha 42b1602e, src_path verified, src_stable=1; the prior sibling stage 962592 B was banked as .prev by the build itself), bridged to nx_cc_sovereign.elf.new by nx_filecopy (verified, hash equal), and /api/promote_toolchain returned TOOLCHAIN-PROMOTED canary=GREEN prev=1 -- buildroot/_offc/nx_cc_sovereign.elf now hashes 42b1602e. The assembler was rebuilt byte-identical to live (a0dbf8f3, 176048 B) so the pair needed one promote. Remaining under this rung: the nx_wgsl rebuild past 4096 (measurement pending), the planted under-count bite, the census organ and the research/refs (queue row above)
2026-09-06	LN60	measure	THE UNIT THAT STOPPED AT 4097 NOW BUILDS: nx_wgsl (shader front-end + both backends + world + cast vertex + cast fragment slice 1) compiled under the promoted compiler 42b1602e -- 1057504 B debug, sha 8db821ce, 875 subprograms, 18144 debug-line rows -- with no pool refusal, where the same source had stopped at `global pool ... measured 4097 against a cap of 4096` under b89d6092. The guard is unchanged and still armed (ir_add_global_* assert against globals_cap); what changed is that globals_cap is now a pass over the token stream plus a named slack. Owed under this rung: the planted under-count bite (a fixture whose synthesised globals exceed the slack must refuse BY NAME, proving the guard is not vacuous after the derivation), the census organ and the pinned research
2026-09-06	LN61	retract	SCOPE CORRECTION BEFORE ANY WORK STARTS ON LN61 LN62 LN63: THESE THREE LARGELY DESCRIBE CAPABILITY THE ESTATE ALREADY BUILT IN JULY 2026 AND I PROPOSED THEM AS NEW. NISHI-FORGE is the incumbent and it is the same shape: nx_forge is the driver (task spec to pack to model to lane build to BYTE-EXACT judge to bounded repair, ledger appended) gate 5/5; nx_forge_ctx emits the pack FROM SOURCES with live stdlib signatures gate 7/7; nx_forge_model is the model backend proven over live loopback gate 6/6; nx_lib_std is the sovereign libc gate 13/13; the vetted-rules registry carries 16 rows that RETIRE their own stale bans; a coding compare board was authored. Its pilot MEASURED the exact thesis the September literature reports: haiku RAW 0 of 3, haiku plus PACK 3 of 3, fable plus PACK 3 of 3, i.e. harness parity at the small-organ tier, with the lift coming from VERIFIED CONTEXT rather than scale or iteration. So LN61 to LN63 are REPOINTED from build to COMPOSE, and the honest remaining gaps are the ones FORGE itself named and could not reach: N6 BATCHED PREFILL, because per-token prefill at 2.4 tokens per second makes a 1300-token pack about nine minutes per task and that is what actually blocks the local tier, and N3 BEST-OF-N pick-first-GREEN, which the free deterministic verifier makes cheap for us. What September ADDS is not the harness but three corrections to its priorities, recorded in the sibling measure row.
2026-09-06	LN61	measure	WHAT SEPTEMBER 2026 ACTUALLY ADDS TO NISHI-FORGE, WHICH IS NOT THE HARNESS BUT THREE CORRECTIONS TO ITS PRIORITY ORDER. ONE, best-of-N moves to the FRONT. FORGE ranked N3 pick-first-GREEN third; GenCorrect [gencorrect-2609-02849] measures five refine rounds worth 177 points against 161 for ALL post-training on the same model, and 198 points on a model with no code-specific RL at all, so the loop outperforms training and it is the rung our free deterministic byte-exact judge makes cheapest in the estate. TWO, the LOCAL TIER TARGET IS PROBABLY WRONG BY AN ORDER OF MAGNITUDE. FORGE staged Qwen2.5-Coder-0.5B and measured a 0 of 3 floor; HEART [heart-2609-01736] reaches 84 percent task completion against GPT-5.4 at 20 with a Qwen3-8B backbone across Planner, Router, Verifier and the tool primitives. An 8B tier also changes the N6 prefill arithmetic, so the tier choice and the batched-prefill rung must be decided TOGETHER rather than in sequence. THREE, PrEx [prex-2609-00579] sharpens WHY the pack works and therefore what a pack should contain. FORGE reasoned that no frontier model has NishiLang in weights so verified facts beat parameters; PrEx measures that models do not apply semantics handed to them at all and are WORST under KeywordSwap and KeywordObf, exactly our case of C-like symbols with different meanings. So a pack lifts by supplying VERIFIED EXEMPLARS TO IMITATE, not by teaching rules, and every future pack rung should weight exemplars and live signatures ABOVE prose rules. The FORGE emitter already does this by construction, which is why it worked.
2026-09-06	LN	measure	THE LANG LADDER IS DELIBERATELY NOT DECLARED, AND THE REASON IS A MEMBERSHIP DISCREPANCY THAT MUST BE RESOLVED FIRST. nx_compare_rank reports rungs=82 for this board. A literal count over this file gives 82 occurrences of the string rung-pipe but only 81 whose id begins with L, and nx_txtscan matches case-insensitively so that is not a case artifact; probes for rung-pipe followed by E, C, D, T, N or F each return zero. So exactly one counted rung either has an id I cannot enumerate, or one occurrence of the string sits in PROSE inside a note and is being counted as a row. THOSE TWO POSSIBILITIES HAVE OPPOSITE REMEDIES AND I CANNOT YET TELL THEM APART, WHICH IS PRECISELY WHY NOTHING WAS DECLARED. A LADDER IS ALL-OR-NOTHING: NO-LADDER is merely LABELED and ranking proceeds, while PARTIAL makes nx_compare_rank REFUSE with exit 6. Declaring two sotatargets and 81 rungroles would therefore leave unplaced=1 and take the estate's largest language board out of ranking entirely, trading a harmless labelled state for a broken one, and if the second possibility is true the board could NEVER be completed because the missing rung does not exist to be placed. THE CHEAP EXPERIMENT THAT SETTLES IT, for whoever picks this up: enumerate the rung ids the ranker itself parses and diff that list against the 81 enumerated here (LB0-LB6, LN1-LN65 including LN13a and the LN board anchor, LR1-LR7); if the ranker's extra entry has no id, its row parser is counting a prose occurrence and that is a defect in the ranker rather than a gap in this plan. The formats board was safe to ladder in one atomic append precisely because its nine rungs were authored in this session and their membership was known exactly.
2026-09-06	LN	land	THE LANG LADDER IS DECLARED AND THE BOARD READS LADDERED: targets=2 rungs=82 placed=82 unplaced=0 badrole=0 badtarget=0 orphans=0 sum=82 with substrate 47, arm 16 and contender 19 summing exactly, alongside BARFRESH bars=5 fresh=5 malformed=0 verdict=FRESH. THE BLOCKER WAS A MEMBERSHIP QUESTION AND REFUSING TO GUESS IT IS WHAT MADE THIS SAFE. The ranker reported 82 rungs while a literal count found 82 occurrences of the row marker but only 81 whose id begins with L; probes for E, C, D, T, N, F, M, W and a leading-space prose mention all returned zero, and the per-group counts (LB 7, LR 7, LN1x 12, LN2x 11, LN3x 11, LN4x 11, LN5x 11, LN6x 7, LN7, LN8, LN9, the board anchor) summed to exactly 81, which proved the missing row was real rather than a miscount. It is rung
2026-09-10	autodev	release	2026-09-10 API-first toolchain delivery: live nx_fileop prepare-install-intent creates immutable checksum-bound plans and accepts identical replay without publication; native15/15 plus guarded ship contentGREEN/behaviorIDENTICAL. Live management daemon c07bc53f exposes /api/v2/promote_toolchain with host-pinned candidate/qualification, durable outcome, target lock and rollback; canonical signed-route13/13 and live wrong-intent refusal verified. Explicit toolchain-v2 registry rows refuse legacy deploy with VERSIONED_OPERATION_REQUIRED. Health initially reported restart transition down, then overallOK; running-executable identity independently matches. Configured runner candidate b947a767 and both intents prepared, RUNNER NOT YET PROMOTED; two other distinct runner copies unchanged. Full receipt knowledge/gates/toolchain-route-live-release-20260910.json. OOM handling, cross-target cohort, automatic journal reconciliation and full-model task savings remain unqualified.
2026-09-17	LN66	queue	Declared from the search R0s-b lane (2026-09-17): __q8blk_i16dot shipped x86-only (toolchain b4310ac4, canary GREEN, equiv 10/10 + selfhost + feature on both hosts); nx_compile_wat and the rv64 emitter carry no OP_I16DOT or OP_Q8BLKDOT case (only nx_ir.nx, nx_types.nx and nx_x86_64_ctx.nx name the ops), so nx_nofloat_q4k.nx and every engine source composing the builtins are x86-only until this rung lands; recipe: add the two cases to the wat emitter beside the OP_ATOMIC lowerings, a scalar case to the rv64 emitter, extend the equiv gate's feature leg with a per-door run, bite the wat case by deleting it and requiring a named refusal
2026-09-17	LN66	land	BOARD UN-REFUSED: nx_compare_rank had refused the whole lang board rc=7 (GRAPH malformed=9 missing_deps=1) because nine rung rows authored 2026-09-03 (LN36 LN37 LN38 LN39 LN40 LN41 LN42 LN45 LN46) carried 5 fields where the graph ruler expects 8, and LN49 depends on LN46; each row received its three missing fields (kind Organ, NOMINAL units 1 with LN42 at 2, deps LN38 on LN37 and LN41 on LN33, the rest none) by anchored edits whose predicted final size 233,728 B matched to the byte (seven rows were CRLF-terminated, two LF); the units are a nominal schema repair the lang seat may re-price; a one-call publish plan boardship-lang was seeded (rank, scoped regen, page verify) so this board ships the way search does
2026-09-22	LN67	land	2026-09-22 the operator's standing order landed as data: goal row rewritten, sotabar sb-lang-rivals (Rust 1.98.1, GCC 16.2, Go 1.27.1, Zig 0.16.0, read from mirrored pages), target lt-superior (WIN on every rival axis by the scorecard, alone on the sovereign axes), rungs LN67 scorecard and LN68 rival bars, and the first ten design rows: the choices already made to keep the human side from erring, each with the error class it prevents, its source kind, its evidence and its measured effect or UNMEASURED
2026-09-22	LN67	lesson	Superior is not a slogan and not a clone: it is a per-axis WIN against a named rival version, plus the axes nobody else has. The board carries the design choices as rows so the reason for each is read, not recalled, and the emitter renders the same ledger for every domain (ecosystem EC66)
2026-09-22	LN67	measure	2026-09-22 first render of the design ledger on this page (ecosystem EC66 landed): rows 10 = adopted 7 + proposed 3 + retracted 0 + refused 0 + malformed 0, unmeasured claims 2, evidence tokens 17 with 0 dead (LR1 and LR2 resolve as rung ids on this plan, not reference keys), verdict CLEAN; the emitted page carries 10 design rows and no raw design row text; page grew 852735 to 858712 bytes, the table

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

SOTA field — 11 peers, 35 axes, measured bindings

11 languages (majors + best-designed), 35 axes, 7 categories. Nishi cells measured (gates with dates); competitor cells documented capability presence, July 2026. Demand weights = 1651 banked oracle bugs. Frontier ladder: /compare/lang/frontier

How the field is scored. A state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured or published numbers (Nishi’s column is measured on this estate, competitor columns are researcher-sourced and cited in the note); grade axes carry Best / Yes / Part / No for every peer. A Nishi grade may be bound to an organ and a symbol and is then re-measured on every publish by the one symbol ruler the capability matrix above uses; an over-claim refuses to publish.

field, strip order:RustZigGoSwiftKotlinTypeScriptPythonCElmOCamlHaskell·BestYesPartNo

Measured bindings. 20 of the Nishi grades on this page are bound to an organ and a symbol and re-measured on every publish by the one symbol ruler: consistent 7, stale-under 0 (the grade says No while the organ carries the symbol -- published with the badge, named by the gate until raised), unbacked 0 (a claim over an absent symbol refuses to publish), unresolved 0, unreadable 0, unserved 13 (a claim over a symbol its organ carries in SOURCE while the organ binary is not on the serving surface -- built nowhere, the class symbol presence cannot see; published with the badge, never refused).

Measured stakes (quantitative)

Native speed vs C (measured / documented)

MODES LEG 2026-09-01: MEASURED 2026-09-01 BY nx_lang_h2h AGAINST THE CANDIDATE COMPILER (NAS sources nx_bck_elide.nx sha ca667131 + nx_opt.nx e40109c6 + nx_compile_x86.nx fc9961fd, built with the promoted toolchain), 7 runs per arm, every arm on checksum 31447040000: gcc -O2 2,082 us median, clang -O2 1,138 us, rustc -O checked 4,394 us, go 4,152 us, NishiLang default 7,145 us, NishiLang f1 mode 4,195 us and drag mode 4,185 us (2.0x gcc, level with Go, ahead of checked Rust), NishiLang checked mode 16,939 us and daily mode 17,011 us. The f1 and drag arms remove exactly the checks the loop guard proves (LN7b) and nothing else; the daily and checked arms pay for LN1 checked arithmetic lowered as six IR instructions per add, which is the next codegen rung (add+jo). EARLIER THE SAME DAY, AGAINST THE PROMOTED TOOLCHAIN (nx_cc_sovereign 778,655 B): identical bounds-checked hot loop, 7 runs per arm, every arm printing checksum 31447040000 -- NishiLang checked 7,152 us median vs gcc -O2 2,148 us = 3.33x (a second independent run 7,241 vs 2,093 = 3.46x); Rust -O checked 4,371 us = 2.03x; Go 4,196 us = 1.95x; clang -O2 1,128 us = 0.53x (it vectorises the loop gcc does not). The Aug-19 laptop copy of the compiler measured 8,508 us on the same host, so the LN7 register-allocation rung is worth 16 percent on this loop, reproduced. The receipt is knowledge/compare/lang.bench (host, every toolchain version, every source and binary sha256, min and median, the exact repro command), rendered on this page as the Measured head-to-head section and refereed by nx_lang_h2h_gate, whose reader re-derives the verdict from the rows. HONEST STANDING: NishiLang is NOT a peer of gcc or Rust on this loop yet -- 3.3x gcc -O2 and 1.6x Rust-checked -- and the rung that closes most of that gap is LR7 sound bounds-check elision (the UNCHECKED NishiLang lane measured 2.02x gcc on 2026-08-14). Nishi MEASURED Stabilizer-validated 2026-05-20 [stabilizer2013] (bench/paired_native_microbench.tsv) vs gcc -O0; root cause stack-machine x86-64 backend, regalloc wired into RISC-V only [poletto1999]; peer columns = commonly documented ranges vs C. RE-MEASURED 2026-08-14 on the CURRENT compiler (674,866 B, eleven promotions later) with bench/nx_lang_h2h.sh, an identical bounds-checked hot loop where all four arms must print the same checksum or the run is void: gcc -O2 unchecked 2,270 us . Rust -O checked 5,041 . NishiLang checked 10,237 . NishiLang UNCHECKED 4,581. So against gcc -O2 the unchecked lane is 2.02x and the checked lane 4.51x. THE FINDING THAT RE-RANKS THE PERF WORK: NishiLang unchecked (4,581) lands within 9 percent of Rust CHECKED (5,041), i.e. the raw codegen is already at the checked-language tier, while the bounds check itself costs 2.23x on this loop. That first pointed the next rung at proving checks away -- and then READING THE EMITTED ASSEMBLY for one checked access moved it again, which is why the assembly is quoted in the ledger rather than summarised. Per iteration of a bounds-checked accumulate loop the backend emits roughly seventeen instructions, of which the check is two compares and two branches while SIX are pure memory traffic: the loop counter lives in r12 and the accumulator in r13 for the whole loop -- register allocation demonstrably worked -- and the emitter STILL spills both to stack homes on entry and reloads the counter twice more, once for the high check and once for the address computation, from a register that never changed. So the dominant cost is not the check and not the missing phi nodes (the two loop-carried values are already in registers); it is that THE BACKEND DOES NOT CONSUME THE REGISTER ALLOCATION IT ALREADY COMPUTED, materialising every value through its stack slot at every use. That is now the ranked number-one perf rung, it is witness-backed by runtime/nx_probe_bchk_asm.nx rather than argued, and it explains why round 3's assembly dump reached the same conclusion in July and was read as a phi problem instead. Stated honestly: this is a DIFFERENT benchmark and a DIFFERENT baseline from the 3.65x figure above (that one is vs -O0 on the paired microbench and has NOT been re-run), so the two numbers are not comparable and neither refutes the other

Rust ~1xZig ~1xGo ~1.2-2xSwift ~1.1-2xKotlin ~1-3x JITTypeScript JIT variesPython ~10-100x interpC 1x barElm n/a (JS)OCaml ~1-2xHaskell ~1-3x

2.0x gcc -O2 in f1 mode, 3.4x default, 5.1x daily (receipt)

Nishi, measured

External defect oracles ingested + classified

langintel- planes: 669 rust I-unsound + 982 LLVM miscompiles, injection-scanned 0/1651, classified into 26 ranked capability axes; top demand compiler-miscompile-codegen 638 = the build order (SSOT knowledge/store/langintel-requirements-)

Rust tracker onlyZig tracker onlyGo tracker onlySwift tracker onlyKotlin tracker onlyTypeScript tracker onlyPython tracker onlyC tracker onlyElm tracker onlyOCaml tracker onlyHaskell tracker only

1651 banked

Nishi, measured

Minimal static native binary (bytes)

Nishi measured 2026-08-13: 188 B return-42 ELF with --no-crash-guard (the deliberate minimal lane); the crash guard is DEFAULT-ON since 2026-08-13 pm and costs +4.9 KB (guarded return-42 = 5,105 B) -- still half of Zig's ~10 KB and 60x under C's typical static; peers = documented typical hello-world static/stripped order-of-magnitude

Rust ~300 KB strippedZig ~10 KBGo ~1.5-2 MBSwift ~500 KBKotlin n/a JVMTypeScript n/a JSPython n/a interpC ~16 KBElm n/a JSOCaml ~1 MBHaskell ~1 MB

188 B opt-out / 5.1 KB guarded

Nishi, measured

Native backends in one shipped toolchain

Nishi counts only true native ELF backends on this axis (x86-64 + RV64 in one sovereign binary); wasm is deliberately NOT counted here -- not a native backend; Zig 0.15 ships its self-hosted x86 backend [zig0151]; Go owns its backend

Rust LLVM (ext)Zig LLVM + own x86Go own, 12+ targetsSwift LLVMKotlin JVM + LLVM nativeTypeScript JS emit (non-native)Python bytecode VMC gcc/clang allElm JS emit (non-native)OCaml own native + byteHaskell GHC NCG + LLVM

2 (x86-64 + RV64)

Nishi, measured

Memory safety and soundness (the public-bug-dump ring)

Compile-time memory safety enforcement

PART SINCE 2026-08-25: the --ownership DECLARED MODE (own_check_move plus own_check_uaf in nx_ownership; nx_ownership_gate 19/19 GREEN on the promoted toolchain, mutation bite killed=1) refuses use-after-move and use-after-free naming the dead local and the line its life ended on; the default is OFF until the per-class ratchet flips it after a clean corpus census, which is the distance to Yes. Rust borrow checker is the bar [rust-ownership] yet 669 I-unsound bugs banked = even the leader leaks (our oracle lane measures it); Nishi raw pointers SIGSEGV -- filed; equiv net GREEN 2026-08-05 = the enforcement lane is OPEN (standing rule: every nx_cc change passes nx_cc_equiv_gate before promotion)

bound to runtime/nx_ownership.nx:own_check_move · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Bounds-checked access (CWE-787/125)

PART, measured 2026-08-23 on the live compiler: typed arrays [N]T and slices []T are bounds-checked BY DEFAULT (NX_BOUNDS_CHECK_LIVE, the LB4 rung, cost measured 2.23x on the checked hot loop) and the raw-pointer half -- the READ-TO-NUL over-read class -- traps only under the --ptrprov DECLARED MODE (LN3, shipped 2026-08-19: exit 71, CWE-125 read and CWE-787 write legs, a provably out-of-range constant index refused at parse time; nx_boundscheck_gate 11/11 GREEN re-run 2026-08-23 after the LN2 promote). Default stays OFF for raw pointers until the per-class ratchet flips it after a clean corpus census, which is the distance to Yes. CISA memory-safe roadmap (banked langbug.q 2026-07-10) [cisa-memsafe] puts this class at the top of what bites C; our 2026-07-08 READ-TO-NUL over-read was exactly this class in the wild

bound to runtime/nx_parse.nx:NX_BOUNDS_CHECK_LIVE · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Use-after-free prevented (CWE-416)

SHIPPED 2026-08-25 inside the --ownership mode: after sys_munmap(p, n) any read of p is a compile error naming the local and the release line (own_check_uaf, nx_ownership_gate 19/19), and a double free falls out of the same rule; default OFF until the ratchet flips it, so PART. Arena no-free doctrine mitigates in practice (nothing frees) but no checker ENFORCES it; Rust the bar; 24 Pin-class bugs in the oracle corpus show the hard tail

bound to runtime/nx_ownership.nx:own_check_uaf · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Integer overflow checked (CWE-190)

PART, SHIPPED 2026-08-23 as the --chkarith DECLARED MODE (LN1): an i64 add, subtract or multiply whose result leaves the i64 range TRAPS with exit 72 naming CWE-190 and the fix, MIN times minus-one traps the same way instead of SIGFPE, __wrap_add / __wrap_sub / __wrap_mul are the exempt intent-declaring forms, and a constant overflow is REFUSED at parse time (capability=checked-arith-const-overflow); nx_chkarith_gate 17/17 GREEN live (passed 9/17 against the banked pre-LN1 compiler: exactly the mode teeth), nx_cc_equiv_gate 10/10 plus selfhost GREEN, default builds byte-identical. Under the default i64 still wraps silently, and the default stays OFF until the per-class ratchet flips it after a clean corpus census -- that flip is the distance to Yes. FIRST RUNG SHIPPED 2026-08-13 on the neighbouring silent-wrong-value: a CONSTANT shift count outside the result width is now REFUSED at compile time, because the processor keeps only the low bits of the count and the program would otherwise compute a different shift than the one written -- MEASURED before the fix: 1 shifted left by 70 compiled clean, ran, and returned 64 (70 becomes 6). The refusal names the legal range, the fix, and capability=shift-count-range; runtime counts and in-range counts are gate-controlled to keep compiling, since an over-eager check would refuse the overwhelmingly common shapes. CORRECTION, measured not remembered: this cell's older note claimed an over-shift 'blanks the emitted .s' (2026-07-06) -- STALE, it compiles and returns the masked value. Zig safe-mode + Swift trap-by-default + Python bignum lead on the overflow half; Go wraps by definition

bound to runtime/nx_checked_arith.nx:chk_add_overflow · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Null / sentinel-zero deref prevented (CWE-476)

PART, SHIPPED 2026-08-23 as the --optenforce DECLARED MODE (LN2): a dereference of a pointer-typed local not proven non-null on its path is REFUSED at parse time naming the local and the rule (capability=option-enforce-unwrap); proof comes from the idioms this corpus already writes (if p != 0 then-block, the early-exit if p == 0 return/break/continue/sys_exit, the else-block, while p != 0, nx_assert_ptr) and a reassignment re-derives the bit, so a stale check does not survive p = call(). Declared floors, each measured against the stdlib: parameters and module statics trusted, sys_mmap results non-null by the allocator contract, int-to-pointer casts trusted, chained derefs through fields or calls unchecked (bind to a local first). nx_optenforce_gate 14/14 GREEN live (hazard refused at p.val, the reassign witness refused, the nine-idiom positive control compiles and runs under the mode with byte-identical asm so the mode emits no IR), 9/14 against the pre-LN2 compiler; nx_cc_equiv_gate 10/10 plus selfhost GREEN. Sentinel-zero-as-null is our recurring P2 meta-class; Option and Result EXIST in the stdlib and the mode now enforces the checked path for locals; default stays OFF until the per-class ratchet flips it after a clean corpus census -- the distance to Yes. Elm ships no null at all

bound to runtime/nx_option_enforce.nx:opt_enforce_unwrap · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Compile-time data-race prevention (CWE-362)

Swift 6 strict concurrency joined Rust Send/Sync as the 2026 bar; Go ships a runtime race detector; Nishi pool is real (7x measured) but untyped

UB / poison semantics defined and checked

54 poison/undef oracle bugs banked (demand rank 3); C UB is the negative bar; managed languages define semantics; Rust unsafe still carries UB (miri checks it). FIRST RUNG SHIPPED 2026-08-13, chosen by MEASURING the edges rather than by taxonomy: the compile-time-decidable UB shapes are being refused one at a time with the capability voice -- constant out-of-range shift counts land first (silent masked-shift, measured 1<<70 = 64 pre-fix), and the runtime traps that remain now SPEAK instead of dying silently (a divide-by-zero SIGFPE prints the arithmetic-trap diagnosis and the divisor advice; that fix-line classifier was itself corrected the same day after it wrongly printed the null-pointer hint on an arithmetic trap -- a wrong hint is worse than no hint). Still No overall: the class is not closed until poison/undef semantics are DEFINED, not merely refused case by case

Type system and correctness

Sum types + pattern matching

Payload ctor + match probes re-verified run-exit=0 2026-07-09; exhaustiveness and unreachable-arm refusal ENFORCED since 2026-08-05 (the next axis carries the proof); Elm/OCaml/Haskell ADTs are the bar; Go lacks sum types

bound to runtime/nx_parse.nx:parse_stmt_match · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

Match exhaustiveness enforced

SHIPPED 2026-08-05, bite-witnessed refuse+accept through /api/build (nx_parse: non-exhaustive match: 2 of 3 variants handled) with the witness in-tree (nx_probe_exhaust_live.nx): EnumEntry now records n_variants and parse_stmt_match counts DISTINCT discriminants (values not arm positions, so duplicated arms cannot fake coverage and explicit = N variants stay correct); gated nx_cc_equiv_gate 10/10 + selfhost -- which doubled as the estate backfill census (zero non-exhaustive matches, so no amnesty was needed) -- and promoted through promote_toolchain canary GREEN. DIAGNOSTIC PARITY-PLUS with Elm (the reason this cell moved to Best): the message CITES THE LINE, NAMES THE ENUM, and NAMES THE MISSING VARIANTS -- nx_parse: line 1118: non-exhaustive match on enum ExhColor: 2 of 3 variants handled -- add an arm for: Blue (no new storage: variant names already live as Enum::Variant module consts). PLUS a second check Elm/Rust-class but ours by construction: UNREACHABLE ARM refusal, citing BOTH lines -- nx_parse: line 1121: unreachable match arm ExhColor::Red -- already handled by an earlier arm of the match at line 1118. Declared narrowness: discriminants outside 0..63, or an unresolvable enum, decline the verdict rather than guess

BEST

Call arity + param-type checking

COMPILER-ENFORCED and bite-proven live 2026-08-05 via /api/build, both refuse+accept directions witnessed in-tree: ARITY (call arity mismatch, forward refs via pre-registered stubs; nx_probe_arity_live.nx) + POINTER-into-INTEGER types (argument type mismatch, the sev-8 silent-zero shape, 0 measured false positives; nx_probe_ptrint_live.nx) + duplicate-definition guard. FULL BOTH-DIRECTION TYPE REFUSAL SHIPPED 2026-08-05 after TWO root fixes, each gated (nx_cc_equiv_gate 10/10 + selfhost) and promoted through the canary toolchain door: (1) the trailing `as T` cast MUTATED THE OPERAND in place, so any local ever written `p as i64` read as INTEGER at every later call -- a silent wrong-type class for every casting caller; cast now emits a typed identity (equiv gate 10/10 + selfhost, toolchain-promoted canary GREEN, witnesses nx_probe_castmut_live/2). and (2) POINTER ARITHMETIC DECAYED TO i64, so the corpus idiom emit(out + o, cap - o) handed a POINTER the parser believed was an INTEGER -- that was the whole 57/70 residue, i.e. the check had been RIGHT about a type the parser had already lost. Named by the equiv gate's newly-captured compiler stderr (a gate that reports a failure without its diagnostic makes the failure unactionable). BOTH DIRECTIONS now refuse, bite-witnessed refuse+accept on the live compiler (nx_probe_intptr_live.nx / nx_probe_ptrint_live.nx). Integer LITERALS stay exempt by design (sentinel/null idiom); fn-pointer calls remain unverifiable by name; arity census crons daily

YES

Generics / parametric polymorphism

Full monomorphization port landed (parse.nx instantiate_generic_n); Rust traits + Haskell typeclasses lead depth; Go type sets since 1.18 [go118]

bound to runtime/nx_parse.nx:instantiate_generic_n · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

HM-class type inference

Explicit-declaration is a named stance (reads better at audit time) yet stays a No under less-than-SOTA-never-design until measured as an exceed

Effect tracking / purity

OCaml 5 effect handlers + Haskell monadic IO + Elm purity are the frontier; watch-class for the substrate

Concurrency

Lightweight concurrency (CSP / actor / async class)

nx_chan Vyukov MPMC + ring-arena pool 7x measured (2026-07-06 gate); goroutines the industrial bar; Zig async dropped in 0.15 pending redesign

bound to runtime/nx_thread_pool.nx:nx_pool_submit · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Structured concurrency

PART SINCE 2026-08-25: scoped spawn LANDED (sc_scope_spawn in nx_thread_pool): join is the only exit, an unjoined scope refuses to free, a child error names which child and cancels the scope, and all 48 nx_pool_submit call sites are byte-for-byte unchanged so colourlessness is preserved. ENFORCEABLE, NOT YET ENFORCED: sc_strict_set(1) makes the bare submit refuse, but it ships OFF because 35 production call sites still use bare submit, and it is a runtime rule where Swift 6 and Kotlin scopes are compile-time law. Swift task trees + Kotlin coroutine scopes = the 2026 design bar; Python TaskGroup 3.11; Go errgroup is a library

bound to runtime/nx_thread_pool.nx:sc_scope_spawn · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

Colorless functions (no async split)

Explicit threads + channels = no function coloring by construction; OCaml effects give colorless concurrency; Rust/Swift/Kotlin/TS/Python all carry the async split

YES

Errors and diagnostics

Errors as values, enforced

Option/Result exist in the stdlib unenforced; the estate-wide refusal-with-reason-and-fix convention is real but convention, not type system; Zig error unions + errdefer; Swift typed throws

PART

Compiler diagnostics (caret, did-you-mean, multi-error)

CARET + DID-YOU-MEAN ARE SOVEREIGN NOW (2026-08-05), bite-witnessed: nx_parse: line 1116: call to undefined function 'dym_helpr' -- did you mean 'dym_helper'? (bounded Levenshtein over the module function table; witness nx_probe_dym_live.nx). It stays SILENT when nothing is near -- a wrong suggestion is worse than none. Every enforcement diagnostic shipped today cites a LINE and two cite BOTH lines (duplicate definition; unreachable match arm). CARET SHIPPED the same day and bite-witnessed end to end: nx_parse: line 1116: call to undefined function 'dym_helpr' -- did you mean 'dym_helper'? / then the offending source line / then ^ under the call. Plumbed ADDITIVELY (a module static the driver fills; unset = no snippet, never a wrong one) so no parse_module caller changed. FIRST ATTEMPT PRINTED THE CARET UNDER THE WRONG LINE (P.pos had advanced past the call, landing on the NEXT statement) and was corrected before promotion by anchoring on the call's own token -- A CARET THAT POINTS AT THE WRONG LINE IS WORSE THAN NO CARET. Arity + undefined-call diagnostics now share that anchor. MULTI-ERROR RECOVERY SHIPPED 2026-08-05 late (gate 10/10+selfhost, canary GREEN, witness nx_probe_multierr_live.nx): 12 semantic sites (undefined call/ident, call arity, arg types, unknown type, non-exhaustive match, unreachable arm, duplicate definition, const-before-decl, bad assigns) now note-and-continue, closed by a hard end gate -- nx_parse: N error(s) -- no output emitted -- so a broken build reports EVERY error in ONE compile and recovered (poisoned) IR can never reach codegen; parser-desync sites stay fatal BY DESIGN (past a desync every diagnostic points at innocent code); cap 20. DID-YOU-MEAN NOW COVERS BARE IDENTIFIERS (witness nx_probe_dym_ident_live.nx: line 1117: UNRESOLVED identifier 'countr' ... -- did you mean 'counter'? plus source line + caret; suggestion pools = live locals window + module consts + function table, ZERO new indexes; the UNRESOLVED diagnostic also gained its line number + caret via the one-slot-back token anchor, verified by emitted bytes). TYPE-NAME DYM TOO (same evening, witness nx_probe_dym_type_live.nx): unknown type name 'TypoPont' (not a primitive, struct, or registered type alias) -- did you mean 'TypoPoint'? -- pools = declared struct table + active generic type params; primitives deliberately excluded (2-4 char names make distance-1 suggestions noisy) and the narrowness stated in-source; gated 10/10+selfhost, canary GREEN. THE 5W+H / ELM-CLASS VOICE IS LIVE ON THE UNDEFINED-NAME FAMILY (2026-08-06, three operator escalations in one night: metadata notes -> quoted declarations -> the full invested logging standard, nxc2-5wh-substrate 2026-04-29 + elm-class-friendliness CARDINAL 2026-05-07). A missing name now reads, verified by emitted bytes end to end through /api/build diag_errors: error at line 1118: I do not know the name 'dym_helpr' -- it is called here, but nothing in this program defines it. / source line + caret / why the build stopped: this name has no definition, so the program would have nothing to run here -- building on would ship a crash or a wrong value at this exact spot. / closest defined name: 'dym_helper', declared at line 1116: + the declaration QUOTED / fix: if 'dym_helper' is the one you meant, change the spelling to match it; if not, define 'dym_helpr' yourself or import the file that provides it. / error: the build found 1 problem(s), listed above, and wrote no program. Rubric self-score ~24/25 (WHAT 5 WHERE 4 WHY 5 HOW 5 NO-JARGON 5; the missing WHERE point is the file name -- the per-file rung). Internal organ prefixes are GONE from these messages. SHIPPING THE VOICE ALSO EXPOSED A STACK TRUNCATION: hostctl echoes only the last 600 bytes of the builder's capture, smaller than ONE 5W+H diagnostic -- the mgmt API now reads the builder's full capture directly, so the API surface carries the whole message. Suggesters are silent stashers; one printer owns the voice; locals resolve by nearest-above scan (shadowing-correct); a const names its evaluated value. REMAINDER CLOSED ON THE HIGH-FREQUENCY SITES (2026-08-13): call arity, reassigning a 'let', duplicate definition, and reserved-keyword-as-name -- the four mistakes any author arriving from another language makes first -- now speak the same what/why/how voice as the undefined-name family, all reported in ONE compile (arity now names the CONSEQUENCE: a missing argument is not empty, the callee reads a leftover register, so the wrong value moves when unrelated code moves and the crash never points back at the call). These are USER ERRORS and deliberately carry NO capability= slug, which is what keeps the demand journal an honest signal of missing CAPABILITY rather than a log of typos. Still on the old organ-prefixed voice: exhaustiveness, unreachable-arm, const-before-decl and the desync sites (anchored by the diag_errors dual-anchor until their rewrite). RUNTIME crash diagnostics (2026-08-13, rungs 1a+1b BOTH shipped same day): SIGSEGV/SIGBUS/SIGILL/SIGFPE now print instruction + fault addresses in the same 5W+H voice and STILL die by the original signal (wait-status unchanged) -- and this is DEFAULT-ON FOR EVERY PROGRAM: the driver appends the self-contained guard and the parser injects the arming call at main entry (--no-crash-guard opts out; measured +4.9 KB per binary; run-behavior byte-equal across the whole equiv corpus). Stack overflow is covered via a 32 KiB alternate signal stack, and the fault classifier names UNBOUNDED RECURSION when the touched address sits at the stack boundary instead of misdirecting to the null-pointer hint. Witnesses prove the EXACT planted fault address prints, the bare-program injection, the opt-out silence (attribution control), and the overflow diagnostic. The resolve loop is now ONE COMMAND: every crash diagnostic prints its own program path (readlink /proc/self/exe) plus the exact nx_addr2line invocation -- the shipped CLI (now REGISTERED over MCP; it was PROMOTED-UNREGISTERED, a real binary nobody could call) prints file:line AND the function name on a -g build and honestly REFUSES (rc=4) without .debug_line. In-process resolution is deliberately NOT embedded: it would drag the DWARF decoder into every ~5 KB guarded binary; the one-command offline loop is the design, stated on the diagnostic itself. CAPABILITY-LIMIT VOICE (2026-08-13 night): when the honest answer is NOT-POSSIBLE, the diagnostic now says whether that is a design stance or a roadmap gap, teaches the supported way, and stamps a greppable capability=<slug> marker at the moment of friction -- (1) a float value into an INTEGER binding used to COMPILE CLEAN and silently store the raw IEEE-754 bit pattern (measured: 1.5 became 0x3FF8000000000000, no diagnostic); EVERY store site -- let, var-init, plain assignment, pointer deref (*p = 1.5), array subscript (a[i] = 1.5), and struct field (s.f = 1.5) -- now refuses through ONE shared guard whose destination type is the pointee/element/field, so float MEMORY stays fully legal (*f64 deref-store control gated) while every integer destination refuses; the first cut covered let only and re-checking the published claim caught the divergence (the multi-error compiler reports all three memory sites in a single build), teaching Q14 fixed-point and leaving the float lane reachable via : f64; (2) the parameter-cap refusal teaches the struct-pointer idiom instead of naming IR internals; (3) the crash guard's pointer branch teaches CHECKED access ([N]T and []T refuse out-of-bounds with a message). The slugs feed the AI-friction transcript mine, so real user friction re-ranks the public roadmap -- the same loop that chose every rung shipped today. HONEST REMAINDER: line numbers are EXPANDED-source lines (per-file mapping is its own rung) and rustc/Elm still carry error codes, --explain prose, and structured/JSON output we do not. Elm + rustc the bar [elm-errors]

bound to runtime/nx_parse.nx:nx_diag_caret · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

YES

Tooling ring

Language server / IDE integration

SHIPPED 2026-08-25: nx_lsp LIVE (436,114 B, registered, invoked), LSP 3.17 over stdio served FROM THE COMPILER'S OWN FRONT END and never a second parser (the rust-analyzer architecture bar [matklad-ide]); every diagnostic the editor shows is the shipping caret and did-you-mean text verbatim; it advertises ONLY textDocumentSync=Full, definitionProvider and hoverProvider, so completion, rename, references and incremental sync stay unadvertised and rust-analyzer, gopls, IntelliJ and the TS server still lead there; nx_lsp_gate 19/19 GREEN on the live binary, mutation bite killed=1. Yes, not Best: the served surface is a subset of the field's

bound to runtime/nx_lsp.nx:lsp_serve · measured PRESENT (decl) · CONSISTENT

YES

Canonical source formatter

SHIPPED 2026-08-23 (LN9, nx_srcfmt, symbol srcfmt_emit): one canonical style with no options, the gofmt shape, and the style was MEASURED from the whole corpus rather than chosen (18,801 files, 2.97 M lines: 4-space indent 2,216,007 vs 9,644; brace on the opening line 179,575 vs 2; joined else 33,968 vs 5,444; struct field type columns aligned in 1,340 of 1,712 multi-field runs) -- a census verb prints the same numbers from the same scanner so the rule and its ruler cannot drift. Comments, string literals and @-directives are preserved byte for byte, and a token-stream ORACLE built on the compiler's own lexer refuses any output whose tokens differ from the input, so nothing is ever written unless the oracle agrees. Proof over the FULL population, not a sample: 18,809 of 18,815 sources format idempotently (fmt(fmt(x)) == fmt(x), 0 exceptions, 0 comment losses) and build to byte-identical assembly; the 6 remaining files use @for range expansion or @macro gensym substitution the formatter does not model and are REFUSED (exit 3, nothing written) -- the declared floor. nx_srcfmt_gate 13/13 GREEN live, bite-proven both ways (alignment killed -> 12/13 RED; oracle broken -> 12/13 RED). The corpus itself is NOT reformatted yet: applying the formatter tree-wide is a separate decision. gofmt set the standard; zig fmt, swift-format, prettier, black follow.

bound to runtime/nx_srcfmt.nx:srcfmt_emit · measured PRESENT (decl) · CONSISTENT

YES

Incremental compilation / build cache

SHIPPED 2026-08-25: nx_inc_compile LIVE (97,470 B, registered, invoked), a per-module cache keyed by the closure sha the build door already computes -- it replays nx_closurehash's key, one key authority not two, three recorded keys byte-equal to /api/build's own closure_sha256 -- with a member list that is a deliberate SUPERSET of the ruler's closure so it errs toward an extra rebuild and never a false hit; measured on the real corpus, 6 targets over 18 modules decided in 5 ms with zero forks. Yes, not Best: the build door does not yet consult it on every build (adoption is the open rung), where every peer's cache is on by default

bound to runtime/nx_inc_compile.nx:inc_cache_lookup · measured PRESENT (decl) · CONSISTENT

YES

Debugger + debug info (DWARF / source maps)

STATEMENT STEPPING SHIPPED 2026-08-25 (nx_dbg_step; nx_dbg_step_gate 29/29 GREEN on the live binary, mutation bite killed=1): breakpoint by file and line, step into and step over on our own .debug_line over an RV64 fixture, never-brick by construction (no ptrace anywhere, breakpoints are a bitmap, code bytes measured unchanged). STILL PART as a conjunction: .debug_info carries function names only, types and variables ABSENT. DWARF v5 .debug_line at STATEMENT granularity, OPT-IN via -g: the compiler emits .file/.loc, nxasm accumulates (address,file,line) and encodes the line program, and the ELF carries the section behind a section-header table. PROVEN END-TO-END 2026-08-07 by nx_dwline_e2e_gate 14/14 -- it drives the real nx_cc_sovereign + nxasm_x86_main, and recovers source lines 5 and 9 from real addresses in the emitted ELF; its load-bearing tooth is the negative control that WITHOUT -g there is no .debug_line at all, so the measured 168 B minimal static binary is untouched. Encoder and decoder are independent organs sharing no code and agree on 13/13 (nx_dwline_roundtrip_gate), and GNU readelf resolves the same addresses, so third-party gdb/addr2line interop is real rather than asserted. STATEMENT granularity landed 2026-08-07, MEASURED AT CORPUS SCALE against the previous build rather than asserted on a fixture: THE ENTIRE RUNTIME CORPUS -- all 11,379 files attempted, 11,121 built (97.7 percent), covering 1,725,477 functions. This is a census, not a sample: no curation, no window, nothing excluded. The 259 files that did not compile are PRE-EXISTING failures, not caused by this change -- in every window where both compilers ran, the built counts were identical under each (377 of 377, 400 of 400). The blessed function-granularity compiler emits EXACTLY one .loc per function, and that 1:1 identity is the control tooth: it held ON THE NOSE in every window where it was independently measured (78,399 rows for 78,399 functions across the two both-compiler windows). The new compiler emits 18,835,389 rows over the same population -- 10.9x denser -- with ZERO per-file regressions across all 11,121 files and no file losing its line info (nx_dwline_corpus_gate, which NAMES every regressing file individually and named none). Where the run used the derived baseline for speed it was CROSS-VALIDATED first: fast mode reproduced the both-compiler numbers EXACTLY on an identical 400-file range (31,000 functions, 165,800 rows, 400 improved, 0 regressed), and the invariant is deliberately NOT asserted in derived mode because that would be circular. The narrow proof is also kept: nx_dwline_stmt_gate 13/13 shows all four source lines of a two-function probe recovered from real addresses in the emitted ELF, with a baseline tooth asserting the OLD compiler LACKS the statement lines so the gain is attributable. Line numbers ride OUT OF BAND keyed by instruction pointer -- struct Instr was NOT widened -- and nx_cc_equiv_gate stayed 10/10 + selfhost with byte-identical ea/eb on every row, proving the change is inert when -g is off. STILL PARTIAL and graded as one: .debug_info (types and variables) and an actual stepping debugger are ABSENT, and this axis is a conjunction -- debug INFO without a debugger is not a debugger. gdb-on-C stays the bar; both are filed rungs, not design choices

bound to runtime/nx_dbg_step.nx:dbg_step_over · measured PRESENT (decl) · CONSISTENT

PART

REPL / interactive development

Python REPL + notebooks the bar; wasm target + nishi-pages could host ours (queued)

Package ecosystem / supply chain

PART SINCE 2026-08-25: pkg_cas_resolve LANDED in nx_pkg (63,205 B promoted, registered, invoked; nx_pkg_gate 19/19): a module resolves by sha256 digest with no version negotiation and ZERO install-time execution proven mechanically (an install hook fires when executed and is absent after a resolve), and a typosquat refuses name-not-pinned. Not Yes: no signature layer, a one-writer unsigned journal, and the compiler import path still resolves by filesystem name. Deliberate different-path bet: content-addressed substrate, no version negotiation, zero dependency-confusion surface -- still graded No on presence until the bet is measured as an exceed

bound to runtime/_hdl_build/nx_pkg.nx:pkg_cas_resolve · measured PRESENT (decl) · CONSISTENT

PART

Probing + in-repo compiler fuzz/self-heal loop (fuzz gen, EMI oracle, splice bisector, native diagnostic-corpus gate, never-brick bless)

Found and named real nx_cc bugs (empty-.s class 2026-07-05; EMI oracle born catching a silent optimizer miscompile [emi2014]; gate 10/10 GREEN 2026-07-07); peers rely on external fuzzers (rustlantis, go-fuzz, csmith). PROBING IS NOW A NATIVE FIRST-CLASS CAPABILITY, not a pile of shell scripts (2026-08-14): nx_langdiag_gate runs the whole language-diagnostic probe corpus in NishiLang -- 11 rows GREEN through the shipped gate runner -- and it closed a real hole in how this estate had been testing refusals. The prior bash cells asserted only THAT a probe was refused (the emitted assembly was empty); a refusal for a COMPLETELY DIFFERENT reason passed them silently, which is the same blind-by-construction shape as a deny-test suite that never asks which rule fired. Every row now pins the refusal to its own rule phrase or capability slug, so a wrong-reason refusal is RED -- BITE-PROVEN by planting a slug the rule never prints, which yields exit=2 want_exit=2 with the reason mismatched, exactly the case the old cell passed. Acceptance rows (must compile AND emit real assembly) are the discrimination control: without them a compiler that refused every input would score full marks on the refusal rows. It composes the estate's incumbents rather than adding a ruler -- nx_gate_lib's fork-and-assert case runner for mechanics, nx_gate_verdict for adjudication (the promote door REFUSED the first build for rolling its own verdict, and migrating was taken over the documented override) -- and it reports a third state, UNRESOLVED, when the compiler under test cannot be found, because 'I could not look' is not 'it is broken'

bound to runtime/nx_cc_equiv_gate.nx:eq_build · measured PRESENT (decl) · CONSISTENT

BEST

Living bug-class ledger wired to language evolution

F1-F16 taxonomy + P1-P10 meta-patterns + 1651 external oracles classified into 26 ranked axes driving make-it-unrepresentable rungs; PLUS an AI-authoring friction lane (2026-08-13): full-population mining of the AI seats' own session transcripts (1,090 files / 2.88 GiB, counted not sampled) ranks which language defects burn agent tokens -- SEGV-class debugging 5,151 hits across 376 sessions, the paren-cast-index silent-truncation trap in 45 -- and the top-ranked reachable trap was root-caused, witness-gated and toolchain-promoted the same day; peers have public trackers, not ledgers wired to language change, and none wires AI-usage telemetry into language evolution; since 2026-08-13 night the loop is CLOSED IN THE COMPILER ITSELF AND COUNTED BY THE BUILD DOOR: capability-limit refusals stamp greppable capability=<slug> markers (float-int-boundary, call-arity-ceiling, memory-safety-enforcement) at the moment of friction, and /api/build now appends every marker to a DURABLE demand journal (knowledge/status/lang_demand.jrnl: epoch, slug, target; bounded 8/build, append-only, never fails a build -- live-bitten: one refused build wrote its 3 rows the moment it failed), so real demand re-ranks the climb with NO human in the circuit; the same session's refusal check also surfaced a 15-site latent parser gap (chained casts `X as *u8 as i64` were HALF-APPLIED forever, the dangler silently skipped) which is now a real chain, witness-gated

BEST

Sovereignty and determinism (the Nishi lane)

Whole-toolchain sovereignty (zero LLVM / GCC / libc beneath)

The chain nx_cc -> nxasm -> ELF is ours bits-up and compiles on the NAS over the mgmt API (build-over-API GREEN 2026-07-06); Rust/Zig/Swift sit on LLVM; Go owns its backend but links foreign substrate below

bound to runtime/nx_compile_x86.nx:func main(argc · measured PRESENT (decl) · CONSISTENT

BEST

No-float integer determinism doctrine (bit-exact cross-platform)

A 100 percent integer LLM trained + greedy-matches the float reference 4-for-4 (2026-07-09); gate-grounded across codec and compute censuses; no peer ships float-free determinism as language doctrine

bound to runtime/nx_nofloat_llm.nx:qmul · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

BEST

Byte-identical reproducible rebuild

Rebuild byte-identical dd1baff6 MEASURED 2026-08-04; Go reproducible-by-default (1.21+) is the bar; JVM/gradle and npm builds are not bit-exact by default

YES

Capability-secured toolchain ops (ocap least-authority, attenuate-only)

X-Nishi-Cap ocap tokens + fixed-arg pinning live-proven 2026-07-08; attenuate-only delegation audited in cap_consent.log; no peer language ships an ocap-gated ops surface

BEST

Verified compilation / translation validation

Nobody mainstream ships it (CompCert is a separate verified C compiler; RustBelt/miri are research); the eqsat engine is CONSUMED by the shipping pipeline since 2026-08-14 (opt_eqsat_pass rewrites real IR; nx_opt_eqsat_wire_gate 5/5 proves x-xor-x folds in the promoted compiler and x-xor-y survives; nx_opt_eqsat_oracle_gate 13/13 is a whole-domain differential check of the strength-reduction pass against the proven rule) [egg2021]; PART, not Yes: differential oracles and an equivalence net are checks, not a proof-carrying compiler, and CompCert-class verification is not claimed

bound to runtime/nx_opt_eqsat_pass.nx:opt_eqsat_pass · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

PART

11 competitors35 axes4 quantitativeNishi best 6 · absent 5bound 20 · stale-under 0 · unbacked 0 · unserved 13

Honest verdict. NishiLang is a real self-hosted systems language with a self-healing compiler loop and five structural exceeds no peer carries: whole-toolchain sovereignty bits-up, no-float bit-exact determinism proven at LLM scale, an in-repo fuzz+EMI+bisector loop, a 1651-bug external-oracle ledger wired to language evolution, and an ocap-secured ops surface. It is not yet a peer of Rust, Swift, or Elm on enforced safety, speed or the tooling ring: overflow (LN1 --chkarith, 2026-08-23), null (LN2 --optenforce, 2026-08-23), raw-pointer provenance (LN3 --ptrprov, 2026-08-19) and ownership plus use-after-free (LN4-LN5 --ownership, 2026-08-25) are enforced only under DECLARED MODES that default OFF, typed arrays are checked by default, and there is no race enforcement at all; the tooling ring now EXISTS -- LSP (2026-08-25), formatter (2026-08-23), incremental cache (2026-08-25), statement stepping (2026-08-25), each gate-proven and each BOUND on this page to its symbol and re-measured on every publish -- but none is yet at the top of the adoption ladder; and the sovereign head-to-head receipt (2026-09-01, promoted toolchain, every arm on one checksum) measures the checked hot loop at 3.33x gcc -O2 and 1.6x Rust-checked, so on speed it is behind and says so with the receipt rendered below (debug INFO, however, is no longer absent: opt-in DWARF v5 .debug_line at function granularity landed 2026-08-07, gate-proven end-to-end and readable by GNU readelf); arity, exhaustiveness (naming missing variants), unreachable-arm refusal, caret + did-you-mean (calls AND identifiers), and multi-error recovery are ENFORCED sovereign-side as of 2026-08-05, each bite-witnessed refuse+accept on the live compiler. Under the less-than-SOTA-is-never-design law every No is filed work: measured demand (1651 oracle bugs) ranks miscompile-detection (638), vectorization (78), and poison/undef semantics (54) first. Discipline: the equivalence net is GREEN (nx_cc_equiv_gate 10/10 + selfhost, re-run 2026-08-13; standing rule: every compiler change passes it before promotion) and the loop now also eats traps mined from AI-seat usage: the paren-primary silent-truncation class -- ("lit" as *u8)[j] compiled clean, silently dropped the index, and left the pointer truncated in the receiver -- was ranked by a full-population scan of 1,090 session transcripts (2.88 GiB; the trap shape appears in 45 sessions), fixed in parse_primary (postfix chain now runs after a parenthesized primary, the same seq1552 class the string-literal path already carried), mutation-proven (gauntlet 32/32 under the fixed compiler, the pre-fix compiler RED on exactly the new cell), and toolchain-promoted canary GREEN 2026-08-13 with the leading-operator statement-break trap pinned CCFAIL in the same gauntlet; the SECOND 08-13 promotion closed the trap's leading-MINUS variant for good -- a continuation line starting with a unary-capable operator used to parse as a separate DISCARDED statement (the 2026-05-19 cross-product wrong-value shape, alive and measured exit-7 that morning) and is now refused by a discarded-pure-expression check in the statement fallback [SUPERSEDED 2026-08-25 BY LN15 tok_line_continuation, recorded 2026-09-02: a continuation line opening with a binary operator now JOINS the expression above it instead of being refused -- nx_linecont_gate 10/10 GREEN on the promoted toolchain proves the joined forms compute (det2x2 fixture, plus, minus, ampersand, star-when-no-store) while a lone operator with nothing above it and the unary-only prefixes still REFUSE; the discarded-pure-expression check stands on its irreducible witness nx_probe_lone_operator, and nx_langdiag_gate, which read RED 9/11 for a week because its two multi-line witnesses had become correct programs, was re-pointed to that contract the same day (debt 1788309098)] (provably-pure roots only, so call and syscall statements stay untouched -- the first cut wrongly refused a bare __syscall and was inverted per the fail-toward-doing-nothing law), speaking the 5W+H voice with file:line, caret, why and fix; equiv net 10/10+selfhost GREEN twice, gauntlet 33/33 with both must-refuse cells and the estate is MEASURED arity-clean (9-target backfill sweep, 56 closure files, ~1625 functions, 0 mismatches incl the compiler's own 692-function closure) -- so the enforcement climb has crossed its diagnostics rungs (arity, exhaustiveness, caret+DYM, multi-error recovery); per-file line mapping and function-granularity DWARF are now CLOSED (nx_dwline_e2e_gate 14/14 + nx_dwline_roundtrip_gate 13/13, 2026-08-07); open: the safety ring, .debug_info (types/variables) and a stepping debugger, regalloc-on-x86, then the tooling ring (LSP, formatter, incremental, stepping debugger). RUNTIME CRASH DIAGNOSTICS rung 1 SHIPPED 2026-08-13: a SIGSEGV/SIGBUS/SIGILL/SIGFPE in a guarded program now prints the instruction address and the fault address in the same 5W+H voice and STILL dies by the ORIGINAL signal (wait-status unchanged) -- one call arms it (nx_crash.nx), the toolchain's own binaries (nx_cc + nxasm) ship armed, the handler ABI and signal-frame offsets are witness-proven by an exact planted fault address (nx_probe_crash_live.nx derefs address 64 and the diagnostic prints 0x...40), and the armed toolchain is proven inert by byte-identical emitted artifacts; this rung was ranked FIRST by the AI-transcript mine (5,151 silent-SEGV hits across 376 sessions -- the largest language-attributable token burn). BOTH named follow-ons SHIPPED the same afternoon: the guard is now DEFAULT-ON for every compiled main (driver-append + parser-inject, --no-crash-guard opt-out, +4.9 KB measured, equiv corpus run-behavior byte-equal) and stack-overflow crashes speak through a 32 KiB sigaltstack with a classifier that names UNBOUNDED RECURSION; remaining: in-process file:line resolution against .debug_line. Climb ledger: debt lane lang-radar-climb-program.

Honest verdict. NishiLang is a REAL self-hosted systems language — sovereign compiler, generics, sum types, two native backends, wasm, and a compiler self-healing loop (fuzz generator + EMI oracle + bisector + never-brick bless) that most toolchains do not carry in-repo. It is <b>not</b> yet a peer of Rust, Zig, Go, or Elm on the axes the public bug dumps say matter most: no memory-safety enforcement, no arity or exhaustiveness checking, no rich diagnostics in the shipping compiler, no LSP, and measured 3.65x slower than gcc -O0. The two genuine <b>exceeds</b> are structural: the whole toolchain is ours bits-up, and the no-float integer-determinism doctrine is proven at LLM scale. The climb: safety checks the language can enforce, the diagnostics port, regalloc on x86-64, and the tooling ring (LSP, formatter, incremental builds).

Measured head-to-head — a receipt, not a claim

Bounds-checked hot loop: NishiLang modes vs gcc, clang, rustc and go. sum a [1024]i64 array 20000 times through a runtime index (20,480,000 array reads); every arm prints elapsed_us= and checksum= and the checksum must be 31447040000 on every arm or that arm is VOID. The C arms are unchecked by the language; the Rust arm indexes with [] so its bounds checks are in play; the Go arm is bounds-checked by the language; every NishiLang arm keeps typed-array bounds checks LIVE and the mode arms add the declared bundles from knowledge/lang_modes.conf (f1 and drag elide only the checks the loop guard proves; daily and checked also enable every safety mode). Measured on west-laptop|Intel(R) Core(TM) Ultra 7 255HX|Linux 6.6.87.1-microsoft-standard-WSL2|nproc=16 on 2026-09-02 (unix 1788318449), 7 runs per arm, reference arm c-gcc-O2 = 1.00x. Every arm had to print the same checksum or its row is VOID and never ranked; an arm whose toolchain is not declared on the host is UNMEASURABLE, an absence rather than a loss. Written by nx_lang_h2h, re-derived here by nx_bench_receipt_lib: reader verdict VALID, writer wrote VALID (writer and reader agree).

Arm	Toolchain	Version	Median µs	Min µs	vs reference	Checksum	Status	Runs	Source sha256	Binary
c-gcc-O2	gcc -O2 (bounds unchecked by the language)	`gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0`	2079	2061	1.00x	31447040000	VALID	7	`897978f2b047`	`c1ecef44f793` 16128 B
c-clang-O2	clang -O2 (bounds unchecked by the language)	`Ubuntu clang version 18.1.3 (1ubuntu1)`	1138	1103	0.54x	31447040000	VALID	7	`897978f2b047`	`10d60f5d0821` 16096 B
rust-O-checked	rustc -O (indexing with [] keeps the bounds checks in play)	`rustc 1.96.0 (ac68faa20 2026-05-25)`	4445	4335	2.13x	31447040000	VALID	7	`9f733cec5a7f`	`f4f893c5d6de` 4347064 B
go-build	go build (bounds checked by the language)	`go version go1.22.2 linux/amd64`	4163	4154	2.00x	31447040000	VALID	7	`bc90d704e03a`	`3d4bb605068b` 1917468 B
nishilang-default	nx_cc_sovereign + nxasm_x86_main (default build, typed-array bounds checks LIVE)	`nx_cc_sovereign sha256=7b8676c1d03c0d0072c4310453e8c8329415638c8e769024789c0c86b99c314b bytes=802927; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	7105	7096	3.41x	31447040000	VALID	7	`b3c398ba3e41`	`2dcbe268af4b` 15765 B
nishilang-checked	nx_cc_sovereign --mode=checked + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=7b8676c1d03c0d0072c4310453e8c8329415638c8e769024789c0c86b99c314b bytes=802927; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	10688	10551	5.14x	31447040000	VALID	7	`b3c398ba3e41`	`d14e5b9a57f6` 26552 B
nishilang-daily	nx_cc_sovereign --mode=daily + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=7b8676c1d03c0d0072c4310453e8c8329415638c8e769024789c0c86b99c314b bytes=802927; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	10567	10540	5.08x	31447040000	VALID	7	`b3c398ba3e41`	`15030f44b177` 29960 B
nishilang-f1	nx_cc_sovereign --mode=f1 + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=7b8676c1d03c0d0072c4310453e8c8329415638c8e769024789c0c86b99c314b bytes=802927; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	4189	4176	2.01x	31447040000	VALID	7	`b3c398ba3e41`	`fc870ae9e99d` 15503 B
nishilang-drag	nx_cc_sovereign --mode=drag + nxasm_x86_main (the mode bundle from knowledge/lang_modes.conf)	`nx_cc_sovereign sha256=7b8676c1d03c0d0072c4310453e8c8329415638c8e769024789c0c86b99c314b bytes=802927; nxasm_x86_main sha256=cf693e3b47e5a1e5f296978ed586782589176a662089c683bd568da74c4aa131 bytes=154977`	4203	4167	2.02x	31447040000	VALID	7	`b3c398ba3e41`	`0c85bec64841` 9383 B

bench arms=9 valid=9 void=0 unmeasurable=0 build_fail=0 run_fail=0 unknown=0 (partition sums) verdict=VALID

reproduce:

cd /mnt/c/Users/elder/nishi-core/nxc2 && ./_build/nx_lang_h2h.sov.elf knowledge/bench/lang_h2h_jo.conf

receipt: knowledge/compare/lang.bench · a rerun on the same host that changes the ranking is a finding, not noise; a rerun on a different host is a different receipt and says so in its host line.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/lang.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain lang, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from lang.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

field|seeds=3|scanned=3|fetched=3|reused=0|failed=0|named=3|candidates=3|mentions=3|capped=0
rival|Rust|1|1|col0-rust|https://doc.rust-lang.org/book/ch04-00-understanding-ownership.html|named
rival|Zig|1|1|col1-zig|https://ziglang.org/download/0.15.1/release-notes.html|named
rival|Elm|1|1|col3-elm|https://elm-lang.org/news/compiler-errors-for-humans|named

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Rust	1	1	col0-rust	named	https://doc.rust-lang.org/book/ch04-00-understanding-ownership.html
2	Zig	1	1	col1-zig	named	https://ziglang.org/download/0.15.1/release-notes.html
3	Elm	1	1	col3-elm	named	https://elm-lang.org/news/compiler-errors-for-humans

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state BLIND (age 52684 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_rvc_gate`	lang	plan-queue	rung=LN9
directive	`nx_dangling_else_gate`	lang	plan-queue	rung=LN30
directive	`nx_dev_pipeline_test`	lang	plan-queue	rung=LN31
directive	`nx_team_roster`	lang	plan-queue	rung=LN31
directive	`nx_andelinwest_build`	lang	plan-queue	rung=LN31
directive	`nx_vcodec_neural_entropy_gate`	lang	plan-queue	rung=LN31
directive	`nx_crash_guard`	lang	plan-queue	rung=LN30
directive	`nx_wasm_memory64_req`	lang	plan-queue	rung=LN35
directive	`nx_net`	lang	plan-queue	rung=LN41

rows shown 9|this board's directives 9|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 632|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rust-ownership] The Rust Project. The Rust Programming Language, chapter 4: Understanding Ownership (ownership, borrowing, and the borrow checker). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rust-ownership.html · pin hb000ae040981e3d15a775e11c6d3567c41967e375d70f7346de8654764f8477a · accessed 2026-08-18 · vendor-docGrounds: The Rust column: Memory safety (bounds, ownership, use-after-free) Best, Use-after-free prevented (CWE-416 class) Best and the lang.sota Compile-time memory safety enforcement Best -- the borrow checker is the bar the own_check_move and own_check_uaf watch contracts are measured against.
[zig0151] Zig Software Foundation. Zig 0.15.1 Release Notes: self-hosted x86 backend default for Debug builds on x86_64, async and await keywords removed pending the std.Io redesign, module-level UBSan modes, zig fmt auto-upgrade. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_zig0151.html · pin h9de868b1d922477b725d3bdb7229ba672801c0aa28dde239c60379dccf3d6963 · accessed 2026-08-18 · vendor-docGrounds: The Zig column and the BARS line (Zig 0.15.1, 2025-08-29): lang.sota Native backends in one shipped toolchain (Zig 0.15 ships its self-hosted x86 backend), Lightweight concurrency (Zig async dropped in 0.15 pending redesign), Integer overflow checked (Zig safe-mode) and Canonical source formatter (zig fmt).
[go118] The Go Authors. Go 1.18 Release Notes: generics (type parameters, type sets), fuzzing in the standard toolchain, workspaces. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_go118.html · pin h3196a875d7e52f2fd6b5726e41f0a614c56906f7b446f27b5df788025b7d2af8 · accessed 2026-08-18 · vendor-docGrounds: The Go column: Generics + monomorphization (Go added generics in 1.18; lang.sota Go type sets since 1.18) and the go-fuzz lineage the In-repo compiler fuzz generator row names as an external fuzzer.
[elm-errors] Czaplicki, E. Compiler Errors for Humans (Elm 0.15.1 announcement, elm-lang.org news): line-cited errors, source excerpts, hints and did-you-mean suggestions. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_elm-errors.html · pin h312d098809ea8a53bf3b337b5e423b8f806d21a9098b1f17b7cafe66a37dab8d · accessed 2026-08-18 · vendor-docGrounds: The Elm column Best on Rich diagnostics in the shipping compiler (caret, did-you-mean, multi-error) and lang.sota Compiler diagnostics: this is the Elm-class voice the 5W+H undefined-name family and the caret + did-you-mean rungs are graded against (Elm and rustc remain the bar on error codes and explain prose).
[cisa-memsafe] CISA, NSA, FBI and partners. The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously (December 2023). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_cisa-memsafe.html · pin hf9d24a5023c144a32eee09e53ddf961809518206cc1419b6b817547a15ef6ede · accessed 2026-08-18 · published-standardGrounds: The PUBLIC BUG DUMPS line (bug_cisa_memsafe, banked 2026-07-10) and every CWE-class safety row: Bounds-checked access (CWE-787 and CWE-125), Raw-pointer access prevented, Use-after-free (CWE-416), Integer overflow (CWE-190) -- the roadmap is why those classes head the safety ring and why the memory-safety gap is graded the largest on this board.
[emi2014] Le, Afshari, Su. Compiler Validation via Equivalence Modulo Inputs. PLDI 2014 (Distinguished Paper Award). EMI project page with the paper and the GCC/LLVM bug tally. publisher · read in our library knowledge/fetched/cmp_lang_emi2014.html · pin hd6ed16853f6aa9fe7071cfcce27bf5f3cd9ff49c3a4bb7f7f142ec6e3ff8e0a6 · accessed 2026-08-18 · published-paperGrounds: The Differential EMI oracle on the compiler gate row and the lang.sota Probing + in-repo compiler fuzz/self-heal loop cell: nx_cc_equiv_gate is the EMI method (equivalent programs must build and run byte-equal) applied in-repo, born catching a silent optimizer miscompile.
[egg2021] Willsey, Nandi, Wang, Flatt, Tatlock, Panchekha. egg: Fast and Extensible Equality Saturation. POPL 2021. arXiv:2004.03082. publisher · read in our library knowledge/fetched/cmp_lang_egg2021.html · pin he3bed05ebf48a84fb260752a3dbb1b8a98a8dec8fc03c72ea9c1573d5b0259df · accessed 2026-08-18 · published-paperGrounds: The Equality-saturation engine row and the opt_eqsat_pass watch contract: nx_eqsat's egg-style deferred congruence closure (rebuild) and e-class analyses (const-fold) are this paper's design, and the Verified compilation / translation validation cell names eqsat as the wired-next oracle.
[poletto1999] Poletto, Sarkar. Linear Scan Register Allocation. ACM Transactions on Programming Languages and Systems 21(5), 1999. publisher · read in our library knowledge/fetched/cmp_lang_poletto1999.html · pin h9cd2d89cf54ac5c10d78bd80a21a99c466f306490ea90cdb19ebd77ae9587349 · accessed 2026-08-18 · published-paperGrounds: The RISC-V target row (the linear-scan allocator nx_regalloc, Poletto-Sarkar, is wired there) and the Competitive native speed vs C row: the x86_use_regalloc watch is about consuming the allocation this algorithm already computes.
[stabilizer2013] Curtsinger, Berger. STABILIZER: Statistically Sound Performance Evaluation. ASPLOS 2013. publisher · read in our library knowledge/fetched/cmp_lang_stabilizer2013.pdf · pin h819c930cc8f51a65a24cdc46452a29ec2c872391724974d21589a8729dac9c49 · accessed 2026-08-18 · published-paperGrounds: The BARS line perf bar (gcc -O0 Stabilizer-validated, bench/paired_native_microbench.tsv 2026-05-20) and the lang.sota Native speed vs C row: the 3.65x figure is a Stabilizer-style layout-randomised comparison, which is why it and the 2026-08-14 h2h numbers are declared different benchmarks and neither refutes the other.
[oncd2024] Office of the National Cyber Director, The White House. Back to the Building Blocks: A Path Toward Secure and Measurable Software (February 2024). Technical report PDF. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_oncd2024.pdf · pin h3244ac0dd424bde0b23a63ec904787d0163951154d0ae546ce683a18e85d9eeb · accessed 2026-08-19 · published-standardGrounds: Memory safety (bounds, ownership, use-after-free) and the safety-ring watch rows (own_check_move, own_check_uaf, bck_ptr_provenance) plus the lang.plan memory-safety-mandate bar: the White House report that made memory-unsafety a national-security finding.
[regehr-ub] Regehr, J. A Guide to Undefined Behavior in C and C++, Part 1. Embedded in Academia blog. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_regehr-ub.html · pin h93435da7091bce40980326e965f50a34b3cdd7e53e29f358dab6b20e0b28dc4d · accessed 2026-08-19 · vendor-docGrounds: Integer overflow checked (CWE-190 class) and the lang.sota UB / poison semantics cell: the canonical statement of silent UB as a miscompilation engine -- the negative bar the refusal-with-reason lane answers, cited by the lang.plan UB bar.
[rustperf2025] The Rust Project. Rust Compiler Performance Survey 2025 Results (September 2025): 55 percent of respondents wait over 10 seconds for an incremental rebuild. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rustperf2025.html · pin h732adfe07406baa416bd46d62201a1214ef37e27d5a2ba22c7e3075a23b420b0 · accessed 2026-08-19 · vendor-docGrounds: Incremental compilation / build cache and the lang.plan adoption-tax bar: the measured compile-latency tax that toolchain.plan B-rungs and the inc_cache_lookup watch exist to refuse.
[rustsurvey2025] The Rust Project. 2025 State of Rust Survey Results (March 2026): community-measured complexity worry and adoption blockers. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rustsurvey2025.html · pin ha6701ab12caecdbdd442d43499a831f65d88a8ab19569ba0955663fd01c9bd5e · accessed 2026-08-19 · vendor-docGrounds: The lang.plan adoption-tax bar and complexity-creep risk: the Rust community's own measured fear that the language grows too complex -- the control group for every annotation NishiLang declines to add.
[tob-supply2025] Trail of Bits. Supply chain attacks are exploiting our assumptions (September 2025): the npm worm record and install-time execution as the root enabler. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_tob-supply2025.html · pin h36a1f2e54ba32c23659dd086647eb6ae8b4cd032673ffbf9a03f393230ac6d1d · accessed 2026-08-19 · vendor-docGrounds: Supply chain by construction (no install scripts, content-addressed, no registry attack surface): the 2025 registry-worm record that makes the zero-install-script content-addressed bet worth measuring as an exceed (pkg_cas_resolve).
[midori-errors] Duffy, J. The Error Model. Midori project retrospective, joeduffyblog.com (February 2016). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_midori-errors.html · pin h0d1f12fe40b8a80fc45663a6e1d12531f65406f9d9ecedbef4162f551079a7c3 · accessed 2026-08-19 · vendor-docGrounds: Errors as values with enforced propagation (the Midori model): typed recoverable errors plus fail-fast abandonment -- the design bar for the res_propagate_op watch and the lang.plan errors bar.
[go-errsyntax] Griesemer, R., for the Go team. On or No syntactic support for error handling (go.dev blog, June 2025): Go closes all error-handling syntax proposals. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_go-errsyntax.html · pin h5d9402af993a26016b3826877d0e4640b363ab2f683247e2bba2c58a0f51796c · accessed 2026-08-19 · vendor-docGrounds: Errors as values with enforced propagation (the Midori model): the 2025 proof that error ergonomics cannot be retrofitted once a community standardizes on the boilerplate -- why rung E1 ships while the corpus is still ours.
[njs-nursery] Smith, N. J. Notes on structured concurrency, or: Go statement considered harmful. vorpus.org (2018). URL witnessed 2026-08-19; vorpus.org refuses the sovereign fetch lane (TLS handshake class), mirror declared absent. publisher · accessed 2026-08-19 · vendor-docGrounds: Structured concurrency (scoped spawn, no orphan tasks): the founding nursery essay -- spawn only inside a scope that joins its children -- the design bar for the sc_scope_spawn watch.
[nystrom-colors] Nystrom, B. What Color is Your Function? journal.stuffwithstuff.com (February 2015). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_nystrom-colors.html · pin h2958fb04a0a37663c1ac992843a4d89f3460326eb203356134894a532f6cd728 · accessed 2026-08-19 · vendor-docGrounds: Structured concurrency (scoped spawn, no orphan tasks) and the lang.sota Colorless functions cell: the colored-function essay naming the async split NishiLang avoids by construction.
[rule-of-2] Chrome Security Team. The Rule of 2. Chromium in-tree security documentation. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_rule-of-2.html · pin hc65a1ed50b0bf606c7331a3ffc9060dad0919ccc9af4cebc9f5793415ed52eb8 · accessed 2026-08-19 · vendor-docGrounds: Safety ring inherited by NishiOS + Nishi Browser (the Rule-of-2 discharge): the browser bar -- untrustworthy input, an unsafe language and high privilege may never combine -- that the nxos_lang_ring_attest watch discharges by measurement.
[ferrocene] Ferrous Systems. Officially Qualified: Ferrocene (TUV SUD qualification of the Rust toolchain, ISO 26262 and IEC 61508). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_ferrocene.html · pin h47438da624dbe83ea88bf196ac969406cf5e5ff860e41834fe346b9e1b6dfec0 · accessed 2026-08-19 · vendor-docGrounds: Written language specification + conformance suite: Rust reached safety-critical qualification only by retrofitting a written spec -- the certification floor the spec_conformance_run watch takes early.
[austral-caps] Borretti, F. Austral tutorial: Capability-Based Security (linear capabilities; authority is a value, never ambient). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_austral-caps.html · pin h0c81921773cac8d9d060ebf0b5bf2dd44dbe56edbafe0dd8aebf9a53939c722f · accessed 2026-08-19 · vendor-docGrounds: Language-level capability security (no ambient authority): the linear-capability design where authority is handed to main and a dependency signature IS its permission manifest -- the bar for the cap_root_main watch.
[matklad-ide] Kladov, A. (matklad). Next Few Years. rust-analyzer blog (May 2020): the IDE-first query-architecture argument. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_lang_matklad-ide.html · pin h9d10fcd196d73d19edfd58e755f3ee65311247a0fb609327257c58655a88465b · accessed 2026-08-19 · vendor-docGrounds: Language server / editor integration: the IDE-first bar -- the lsp_serve watch consumes the compiler's own front-end, never a second parser.
[llvm-irce] LLVM Project. InductiveRangeCheckElimination.cpp -- the IRCE pass that splits a loop into pre, main and post loops so the main loop provably needs no range checks (header comment). Source read from the mirrored file. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_llvm_irce.cpp · pin h5ec2cdfaf42e112cdb195f98ef6cdad06189177de22682f646e193e620a22bb3 · accessed 2026-09-01 · source-readGrounds: Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop)
[go-prove] Go Authors. cmd/compile/internal/ssa/prove.go -- the prove pass with per-value Limit{Min,Max,Umin,Umax} lattices used to remove bounds checks. Source read from the mirrored file. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_go_prove.go · pin he9d0e71a2d91deb363ab65e0a9da7480929d76cd607f021edaf3cfe8cceb65e5 · accessed 2026-09-01 · source-readGrounds: Induction-guarded bounds-check elision (a loop guard proves the single check inside its loop)
[llvm-vectorizers] LLVM Project. Auto-Vectorization in LLVM: the Loop Vectorizer and the SLP Vectorizer (llvm.org/docs/Vectorizers.html). Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_llvm_vectorizers.html · pin h5928cd2813ff9510440b844efb73cc1c56c57472e0a3806e7fc4120e80d61b06 · accessed 2026-09-01 · vendor-docGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-autoveccoder-2026] Li, S., Yin, X., Jin, X., He, Y., Zhou, Y., Li, Y., Han, X. AutoVecCoder: Teaching LLMs to Generate Explicitly Vectorized Code. arXiv 2605.17978, submitted 18 May 2026 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2605.17978.html · pin h1e05cf26b477a6b8e39f2c83190918ce1e5133285b5830c7b82d0a25e553d57e · accessed 2026-09-01 · published-paperGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-nanokernels-2025] Thangamani, A., Shahid, M. A. A., Siemieniuk, A., Morel, R., Golin, R., Heinecke, A. Library Liberation: Competitive Performance Matmul Through Compiler-composed Nanokernels. arXiv 2511.13764, submitted 14 Nov 2025 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2511.13764.html · pin h4b329a93f1dfa0a37cf56b2b73b291ab09f36e7d016d455e4d5fa9aedf7688c1 · accessed 2026-09-01 · published-paperGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-eggmind-2026] Yin, C., Xiao, Y., Luo, Y., Zou, Y., Liang, Y. LLM-Guided Strategy Synthesis for Scalable Equality Saturation (EggMind, EqSatL). arXiv 2604.17364, submitted 19 Apr 2026 (abstract read from the mirrored page). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_2604.17364.html · pin h3c6cdfc012418e01b734bfebb727b971594ed5ceb1d666e64139913dfe6f1241 · accessed 2026-09-01 · published-paperGrounds: Equality saturation CONSUMED by a backend
[arxiv-autovec-list-2026] arXiv. Search listing: auto-vectorization compiler, newest first, as retrieved 1 September 2026 (the dated index the vectorization survey was drawn from). publisher · read in our library knowledge/fetched/cmp_lang_arxiv_autovec_2026.html · pin h3c9b5e2ab2e05eb3b1e61cd86a29619b9b945d82ae48ed0a09d17dfbe27c5a53 · accessed 2026-09-01 · mirrored-indexGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[arxiv-eqsat-list-2026] arXiv. Search listing: equality saturation vectorization, newest first, as retrieved 1 September 2026. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_eqsat_vec_2026.html · pin he3b2a8b48799afce47f847547909334c390c981a368dca3011fbf1effdfb7b9a · accessed 2026-09-01 · mirrored-indexGrounds: Integer SIMD reduction vectorization (packed adds for the accumulate loop)
[energy-languages] Pereira, R. et al. Energy-Languages (greensoftwarelab): the RAPL-instrumented CLBG harness behind Energy Efficiency across Programming Languages (SLE 2017) -- repository README read from the mirror. Accessed September 2026. publisher · read in our library knowledge/fetched/cmp_lang_energy_languages_readme.md · pin h3cfb5612f10b49b78944e92c50bc7bdaf9bdf9940417f8c41b82bfad7ac2e74e · accessed 2026-09-01 · vendor-docGrounds: Energy per run on the receipt (RAPL package energy per arm)
[gcc16] GCC 16 changes (16.1 released 2026-04-30, 16.2 2026-08-07): hierarchical C++ diagnostics, SARIF 2.2-track output with logical-location nesting, experimental HTML and directed graphs, the legacy JSON format removed; and vectorisation of uncounted loops with VLA alignment peeling. publisher · read in our library knowledge/fetched/cmp_lang_gccgnuorggcc16changeshtml.html_ · pin hbcd975864eabdfd76246e98bbae24b0a336364ee47d9df51bd2e4e7635a79805 · accessed 2026-09-04 · vendor-docGrounds: Diagnostic object model rendered by three emitters
[rustc-annotate] rust-lang/rust PR 150032, merged 2025-12-17 for 1.94.0 (released 2026-03-05): annotate-snippets becomes the only stable human renderer, adopted after its output was matched to the old emitter over the test corpus; cargo has not migrated (rust-lang/cargo 15944). publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull150032.html_ · pin h4a7837c2f91f472ec7cf99ec5b884e101ec9bfd9608aca0aeeb50dafe0d39196 · accessed 2026-09-04 · source-readGrounds: Renderer snapshot corpus over the refusal census
[gcc-sarif-schema] gcc-patches, June 2024: the GCC testsuite validates every generated SARIF file against the SARIF schema and SKIPS the validation when the validator tool is absent; the mechanism is 2024, so it is a bar, not a 2026 frontier. publisher · read in our library knowledge/fetched/cmp_lang_mailarchivecomgccpatchesgccgnuorgmsg3440.html_ · pin hc57ce7eea2cd91b3c8aea688fe502f42f1a5f7a45cdf98ea80623619d045ef20 · accessed 2026-09-04 · source-readGrounds: Machine-readable diagnostics validate against a pinned schema
[sarif-tc] OASIS SARIF TC page: the only published document is SARIF 2.1.0, OASIS Standard 27 March 2020; 2.2 exists as a draft tree in the sarif-spec repository with no dated status, so it is UNDATED and watched, not cited as a standard. publisher · read in our library knowledge/fetched/cmp_lang_oasisopenorgcommitteestchomephpwgabbrevs.html_ · pin hb369429ef9849975be668e0779e49c379cf665de49b268e5b71a5874249839e0 · accessed 2026-09-04 · published-standardGrounds: Machine-readable diagnostics validate against a pinned schema
[optimuzz] Kwon, Jang, Lee, Heo. Optimization-Directed Compiler Fuzzing for Continuous Translation Validation. PLDI 2025 (presented 2025-06-20, DOI 10.1145/3729275): fuzzing directed by which optimisation changed, with a refinement oracle per pass, found 55 new LLVM miscompilations. publisher · read in our library knowledge/fetched/cmp_lang_pldi25sigplanorgdetailspldi2025papers26o.html_ · pin h40a5292a960aa2b727f3a2a3addc0a1b68961427b95eebbd10221785dbd09c6a · accessed 2026-09-04 · published-paperGrounds: Optimisation-directed fuzzing with a per-pass refinement oracle
[issuemut] Liu, Qin, Legunsen, d Amorim. Learning Compiler Fuzzing Mutators from Historical Bugs, MSR 2026 (13-14 April 2026; arXiv 2510.07834): 587 mutators mined from 1,760 GCC and LLVM bug reports found 65 new bugs, 60 confirmed or fixed. publisher · read in our library knowledge/fetched/cmp_lang_2026msrconforgprofilemarcelodamorim.html_ · pin h3733c660d8662bbac1787508665b7ce8ab55d2695aad96b9f6ee25fb5554fae9 · accessed 2026-09-04 · published-paperGrounds: Mutators mined from the compiler own bug history
[wasmtime-adv] Bytecode Alliance security advisories: Wasmtime and Cranelift commit to continuous formal verification of lowering rules against the ISA model in CI after a verified-rule staleness class of defect. publisher · read in our library knowledge/fetched/cmp_lang_bytecodeallianceorgarticleswasmtimesecur.html_ · pin h83dd7f55214355b7a6f6310cce6c5815553168bd5a9a1587420659aeb3d92148 · accessed 2026-09-04 · vendor-docGrounds: Lowering-rule verification kept fresh against the model
[compcert318] AbsInt release notes 2026-03-20: CompCert 3.18 (after 3.17 in February 2026), the verified C compiler as certified shipping practice. publisher · read in our library knowledge/fetched/cmp_lang_absintcomreleases260320htm.html_ · pin hca002ae0a79eebf393ee65de6f113fa0afecaa810a9e786f659317248c047734 · accessed 2026-09-04 · vendor-docGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[brack] Brack: a verified Scheme compiler via CakeML, mechanised in HOL4. CPP 2026 (co-located with POPL 2026). publisher · read in our library knowledge/fetched/cmp_lang_popl26sigplanorgdetailscpp2026papers15br.html_ · pin h78dcf96c3a11b1dc342ae9cb4c3541aaa11157e6a52a9ea7361de975788a5dd2 · accessed 2026-09-04 · published-paperGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[rinard10x] arXiv 2605.08927 (2026-05): full verification costs about ten times credible compilation when a coding agent writes the compiler and its certificates; the certificate-plus-independent-checker shape is the cheaper rung. publisher · read in our library knowledge/fetched/cmp_lang_arxivorgabs260508927.html_ · pin h618fc69c3a61c75d6b9d0cf234132c63dc10f4eb49e879a4800a58faf2fcea8c · accessed 2026-09-04 · published-paperGrounds: Certified compilation as the oracle; per-pass certificates as the unit
[peepholebench] PeepholeBench, arXiv 2607.02684 (2026-07): coding agents do not yet match humans on the correctness and profitability of missed peephole optimisations; two axes, sound and profitable, scored separately. publisher · read in our library knowledge/fetched/cmp_lang_arxivorgabs260702684.html_ · pin h3d1186b6860840b809148b5afbd47fdc51037ed0e9da713b76e6f7fc6db00b44 · accessed 2026-09-04 · published-paperGrounds: Missed-peephole two-axis harness
[crater159343] rust-lang/rust PR 159343 (2026): a Crater run over 1,026,208 crates with a thirteen-way result taxonomy that names spurious regressions and fixes by reason and re-runs only the rows that changed. publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull159343.html_ · pin h3c47c98ed24c39fa3376760273b316baec330f3ae394f2e3f0b4d88e190a6609 · accessed 2026-09-04 · source-readGrounds: Whole-ecosystem rebuild census with a named-reason spurious partition
[fedora45] Fedora 45 mass rebuild, July to August 2026, against GCC 16.2, glibc 2.44 and binutils 2.47: the distribution-scale rebuild as routine practice, ALREADY-COMMON, a bar for the census row. publisher · read in our library knowledge/fetched/cmp_lang_fedoraprojectorgwikifedora45massrebuild.html_ · pin hfa2e087f71324af484e8307ace18f4af059ab286d3ec075b59a8ee7ca4c5ce70 · accessed 2026-09-04 · vendor-docGrounds: Whole-ecosystem rebuild census with a named-reason spurious partition
[rustc-directives] rustc dev guide, test directives: a known-bug directive REQUIRES an issue number, the crashes suite goes red when a crash stops reproducing, and ignore is a distinct verdict from an expected failure. publisher · read in our library knowledge/fetched/cmp_lang_rustcdevguiderustlangorgtestsdirectivesh.html_ · pin h21f02d12f6025540bbe4f7ceb713a07f5859e51f66e7766f000eb2e00806b019 · accessed 2026-09-04 · vendor-docGrounds: Known-bug rows require an issue id and go RED on unexpected pass
[llvm231] LLVM 23.1.0 release notes (2026-08-25): lit expect-fail and unsupported vocabulary, with a new unsupported listing flag; the vocabulary is ALREADY-COMMON and a bar for the known-bug row. publisher · read in our library knowledge/fetched/cmp_lang_releasesllvmorg2310docsreleasenoteshtml.html_ · pin h760b41fdcb5b796cdcae4ee413eb81b8b9f5583e9497f0cae756df17476a8eee · accessed 2026-09-04 · vendor-docGrounds: Known-bug rows require an issue id and go RED on unexpected pass
[regalloc3] regalloc3 commit history (active June and August 2026): a backtracking register allocator developed with generated-function fuzzing, the successor line to the allocator Cranelift ships. publisher · read in our library knowledge/fetched/cmp_lang_githubcomamanieuregalloc3commitsmain.html_ · pin h5aacc0672ee88377512bc4bc3f516d0545b48b1857ae7b79ac513a9240567a56 · accessed 2026-09-04 · source-readGrounds: Backtracking register allocator fuzzed with generated functions
[egraphs2026] EGRAPHS 2026 workshop programme at PLDI 2026: the field state of equality saturation, with bounded acyclic e-graphs (the Cranelift aegraph form) and stochastic-search controls as the shipped and the studied shapes. publisher · read in our library knowledge/fetched/cmp_lang_pldi26sigplanorghomeegraphs2026.html_ · pin h22f73b4592c07f94fda2fa02006316a387913ca32bbcb81a6b455a7721a273c7 · accessed 2026-09-04 · mirrored-indexGrounds: Bounded acyclic e-graph with a stochastic-search control
[guix150] LWN on Guix 1.5.0 (2026): the full-source bootstrap gains Zig and Mono chains and ships SBOMs for the seed, the reference point for bootstrap trust. publisher · read in our library knowledge/fetched/cmp_lang_lwnnetarticles1088279.html_ · pin h2f90bbc83fc3f7122b0c3ac0e188387638e7fd418b2734431100608c5d18f2eb · accessed 2026-09-04 · mirrored-indexGrounds: Full-source bootstrap chain with an SBOM of the seed
[rust-stage0] rust-lang/rust PR 149888: rustc stage0 is a downloaded prebuilt beta (2025-05-29 line) checked by repro-check rather than a from-source chain; the honest bar a self-hosting toolchain is measured against. publisher · read in our library knowledge/fetched/cmp_lang_githubcomrustlangrustpull149888.html_ · pin h7f10819a59f04eec4a53c791ee9bae6d984296ae84b8390bbe4b5bdae3a65292 · accessed 2026-09-04 · source-readGrounds: Full-source bootstrap chain with an SBOM of the seed
[debian-repro-gate26] debian-devel-announce, May 2026: unreproducible packages are blocked from migrating to testing; reproducibility as a gate, admitted on the deploy board as DL14 and cross-cited here. publisher · read in our library knowledge/fetched/cmp_deploy_listsmsg00001html.html · pin h2d116d37b0ba5f990482e715e6281c913837380e65768cadbb0b105515bc5dbf · accessed 2026-09-04 · vendor-docGrounds: Reproducibility as a migration gate (bar; deploy DL14 owns the unit)
[arxiv-csse-2026-09] arXiv API listing, the COMPLETE cs.SE population for 2026-09-01 to 2026-09-07: totalResults 55 reconciles exactly against 55 entry elements, so the population is complete by construction rather than capped by max_results. Carries the abstracts of SWE-Gate 2609.04167, HEART and ToolFace 2609.01736, GenCorrect with Nemotron-3-Nano-CC 2609.02849, Eiffel-tools LSP 2609.03086, behavior-tree vulnerability detection with a quantized local model 2609.01758, MaP-SQL 2609.00834 and the placebo-controlled fault-localization study 2609.00854. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_csSE_sept2026.xml · pin hf568bff79791e4d2f2486a1af0e884146aa590223806d48f937d4e9f77ebc113 · accessed 2026-09-06 · mirrored-indexGrounds: A weak or small model reaches strong programming performance through an external decider, never through model knowledge
[arxiv-cspl-2026-09] arXiv API listing, the COMPLETE cs.PL population for 2026-09-01 to 2026-09-07: totalResults 14 reconciles exactly against 14 entry elements. Carries the abstract of PrEx 2609.00579 (accepted at LMPL 2026), which asks whether an LLM applies operational semantics handed to it in the prompt and measures that it leans on pre-training priors instead, performing especially poorly on MODIFIED semantics and degrading further as program complexity increases. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_csPL_sept2026.xml · pin hc0f8b857cb952f9e646523a5c83ef7668d1683dcce2078f2396740cb67457b9e · accessed 2026-09-06 · mirrored-indexGrounds: An LLM does not apply programming-language semantics it is handed, so a sovereign language whose semantics no model has priors for cannot rely on in-context teaching
[arxiv-slm-2026-0809] arXiv API listing, the COMPLETE population of papers whose abstract contains the phrase small language model for 2026-08-01 to 2026-09-07: totalResults 35 reconciles exactly against 35 entry elements. MEASURED WHITE SPACE: across all 35 titles and abstracts the string code generation occurs 0 times and the string programming occurs 0 times, measured with nx_txtscan count over the pinned bytes. Scope stated honestly: this is the phrase in the abstract, so a paper describing a 3B model without using that phrase would not be captured, making this a strong signal rather than a proof of absolute absence. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_slm_augsept2026.xml · pin h16776b9e0a5ade19189e6805dc52af3c316d36cd19ee28d28d3ae307393edd5d · accessed 2026-09-06 · mirrored-indexGrounds: The current small-language-model literature does not address programming at all, so the small-model programming lane is unclaimed
[arxiv-swebench-2026-09] arXiv API listing of the newest work citing SWE-bench, sorted by last update and retrieved 2026-09-06: 120 entries of which 4 carry a first-publication date in 2026-09. Used as the currency control for the coding-agent bar, confirming the benchmark line is still the active comparison surface in the current month. publisher · read in our library knowledge/fetched/cmp_lang_arxiv_swebench_newest.xml · pin h9a3d3ca4c20267c68d517d77826341a38c7831bbf04869559e3556216c91d010 · accessed 2026-09-06 · mirrored-indexGrounds: Functional test passing is not a completion signal for a coding agent
[prex-2609-00579] PrEx full text, LaTeXML HTML from the arXiv agnostic-format lane (not a PDF, not a summarising fetcher). Verified in full text: the two semantic shifts are KeywordSwap and KeywordObf, where models must OVERRIDE FAMILIAR SYMBOL MEANINGS to follow the provided rules, and performance is especially poor there. Failure direction is the flattering one: on Fuzzer-Generated and LLM-Translated splits false success is more common, with models frequently declaring invalid programs executable despite the supplied semantics. Built on PLSemanticsBench C-star programs extended with five semantics-aware invalid transformations, evaluated under two formalisms. publisher · read in our library knowledge/fetched/cmp_lang_prex_2609_00579_full.html · pin hfab90166c2532dc5f59e684a9e45af0d128a6d567768604766431e9a0521c409 · accessed 2026-09-06 · published-paperGrounds: An LLM does not apply programming-language semantics it is handed, and it fails hardest exactly where symbol meanings are overridden
[heart-2609-01736] HEART full text, LaTeXML HTML from the arXiv agnostic-format lane. Verified in full text and materially stronger than the abstract: the default backbone is Qwen3-8B, an 8B open model, used across Planner, Router, Verifier and the Tool Primitives themselves. On 50 real-world tasks HEART reaches 84 percent task completion against GPT-5.4 at 20 percent and Claude-4.6-Sonnet at 24 percent. It reduces API cost by up to 7.4 times relative to GPT-5.4, and HEART with the Qwen3-8B backbone matches the hybrid GPT-5.4 configuration on most metrics while costing over 12 times less than HEART with GPT-5.4 throughout. The paper states Tool Primitives integrate with arbitrary backbone LLMs without architectural modification, so the orchestration layer and the execution layer scale independently. publisher · read in our library knowledge/fetched/cmp_lang_heart_2609_01736_full.html · pin hb5d604b89baf359089d6401ea3765079616325a5716c776ecf69e920fe06befb · accessed 2026-09-06 · published-paperGrounds: An 8B open model inside a retrieval-plus-verifier harness beats frontier models on task completion at a fraction of the cost
[gencorrect-2609-02849] GenCorrect and Nemotron-3-Nano-CC full text, LaTeXML HTML from the arXiv agnostic-format lane. Verified in full text with a sharper decomposition than the abstract gives: Score@1 on IOI 2025 rises 130 to 280 after SFT, to 291 after RL, then to 468 after FIVE GenCorrect rounds under the official 50-submission limit, exceeding the gold threshold of 438.3. Post-training therefore contributed 161 points and the test-time feedback loop contributed 177, so the loop bought more than all post-training combined. Nemotron-3-Ultra-CC reaches 304 with no code-specific RL and 502.0 after five GenCorrect rounds, i.e. 198 points from test-time compute alone. publisher · read in our library knowledge/fetched/cmp_lang_gencorrect_2609_02849_full.html · pin h683116aa2db34e4852c3a982921ee06b5a8da079154ab132c79ec4113ff6f42b · accessed 2026-09-06 · published-paperGrounds: A test-time generate-evaluate-refine loop buys more capability than post-training does, on a model with 3B active parameters
[eiffeltools-2609-03086] Eiffel-tools full text, LaTeXML HTML from the arXiv agnostic-format lane. A language server for Eiffel that uses language-specific and project-specific knowledge to direct an LLM, verifies every output with a static verifier, corrects or rejects it, and handles retries until the program passes verification. Bug-fixing evaluated on two public datasets with three models, fixing 76 to 95 percent of bugs depending on model and prompt, with an explicit trade-off reported between number of fixing attempts and success rate. publisher · read in our library knowledge/fetched/cmp_lang_eiffeltools_2609_03086_full.html · pin h0a4a99a5dd3321c5ba3b17628a545dbdd69a42f4ae8c550ee56e22bd7cf83f1b · accessed 2026-09-06 · published-paperGrounds: A language server plus a static verifier in a retry loop is what makes a weak model produce correct programs in a language it does not know
[rust-releases-2026-09] releases.rs Rust Versions page read 2026-09-22: Stable 1.98.1, Beta 1.99.0 due 1 October 2026, Nightly 1.100.0 due 12 November 2026 publisher · read in our library knowledge/fetched/cmp_lang_rust_releases_2026-09.html · pin hc113a5ffb35a695250978cfe1f0a58c9c55ce8ad5e87eb7df922cb73f40bb80c · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[gcc16-changes-2026-09] GCC 16 Release Series changes page read 2026-09-22: sections for GCC 16.1 and GCC 16.2 present, AMX-TRANSPOSE removed, diagnostic machinery cleaned up in GCC 16 publisher · read in our library knowledge/fetched/cmp_lang_gcc16_changes_2026-09.html · pin h08d0af145907d48365cae32b2b92484af35e1c7bddcfa7c84d9245de8cfbb8c8 · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[go-release-history-2026-09] Go release history read 2026-09-22: go1.27.0 released 2026-08-19, go1.27.1 released 2026-09-01 publisher · read in our library knowledge/fetched/cmp_lang_go_release_history_2026-09.html · pin h10fa2f83a0e37e1663172a96f102f59ce40f02506d89e3a6f08c5a2d1c63a0af · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[zig-download-2026-09] Zig download page read 2026-09-22: master then 0.16.0 as the latest tagged release, 0.15.2 and 0.15.1 before it publisher · read in our library knowledge/fetched/cmp_lang_zig_download_2026-09.html · pin hf735c426da51b8ef6d64d098be51cc99e51a24f54e4e97ea8acbce1cf270fec6 · accessed 2026-09-22 · vendor-docGrounds: Superiority scorecard: every axis measured against every rival
[arxiv-cspl-2026-09-22] arXiv API listing cs.PL with memory safety, compiler or ownership, sorted by submission date, 30 entries read by date on 2026-09-22, newest 2026-09-21 publisher · read in our library knowledge/fetched/cmp_lang_arxiv_pl_2026-09.xml · pin hba98b4a8ac83f5e6b0b503e483bf4359fc0c0b322d6dbce4dc5ca9f0f312d495 · accessed 2026-09-22 · mirrored-indexGrounds: Superiority scorecard: every axis measured against every rival

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/lang.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls