Nishi Compare · capabilities, evidence and delivery

Observability

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

How the estate SEES a live system -- metrics, attribution, blind-axis alarms and storm diagnosis -- against the observability field. Rival marks are vendor-doc and open-source-doc reads, run OUTSIDE the estate as oracles, never in our build or run path.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The estate already sees things the observability field does not: an axis that ABSTAINS rather than acquits when it cannot read, a graded alarm about a detector's own blindness, leak detection by sustained growth across every window rather than by a level, a kernel-to-user ratio graded as a first-class verdict, and one I O-storm ruler shared by the spawner and the build gate so the two can never disagree. What it lacks is the field's whole collection half: no block-device throughput or queue-depth axis, no connection-churn axis, no attribution of load to processes we do not own, no fork-source attribution, no burn-rate alerting, and no trace spans. And the sharpest gap is not a sensor at all: a 935 KB churn journal carries a severity on every row that NOTHING READS.

Where we need to go. A host and fleet that can be diagnosed WITHOUT a human writing ssh probes -- every number that decided the 2026-09-03 incident available from an organ, every severity read by an actuator, and every instrument honest about its own cost -- so the hub-and-spoke swarm governs on measured attribution rather than on load average.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the writeback-congestion axis and the shared child reaper with its 9 of 9 bite-proven gate both landed in one leg on 2026-09-03; estimates are relative to those.

Where we are: 8 open rungs. Nine capabilities present with five of them exceeding the field; the collection and attribution half open. Counts measured at emit below this line.

Cost to close the diagnosis loop: 1 u. OB5 a reader for the churn severity. The sensor has been writing sev on every beat since July and no actuator reads it -- the cheapest rung on this page and the one that stops the storm recurring unobserved.

Cost to see the device and the network: 2 u. OB1 the diskstats axis and OB2 the connection-churn axis. Both were hand-read over ssh to diagnose the 2026-09-03 storm, and md4 at 14.2 MB per second with 2157 I Os queued was the number that settled it.

Cost to honest attribution: 3 u. OB3 foreign-load share and OB4 fork sources by parent. Together these answer WHOSE load this is, which is the question our one-sided admission ring currently cannot ask.

Cost to the field's alerting and tracing ring: 5 u. OB6 two-window burn rate with a bounded action rate and a minimum denominator, OB7 observer-cost accounting, OB8 trace spans across fork and exec.

Research bar. Prometheus is measured on pull-based metrics with a query language and recording rules. Theirs: the open-source collection bar. Ours: OB1 OB2.

Research bar. Grafana is measured on dashboards and alert rules over multiple backends. Theirs: the presentation bar. Ours: OB6.

Research bar. OpenTelemetry is measured on vendor-neutral traces, metrics and logs with context propagation. Theirs: the tracing bar. Ours: OB8.

Research bar. New Relic is measured on APM with transaction traces, host attribution and applied intelligence. Theirs: the commercial APM bar. Ours: OB3 OB4.

Research bar. Datadog is measured on host and container metrics, live process monitoring, watchdog anomaly detection. Theirs: the live-process attribution bar. Ours: OB3 OB4.

Research bar. Google SRE burn-rate alerting is measured on multiwindow multi-burn-rate alerts, 14.4x over 1h with a 5m short window. Theirs: the alerting-discipline bar. Ours: OB6.

Research bar. Netdata is measured on per-second host metrics including diskstats and socket state out of the box. Theirs: the high-resolution host bar. Ours: OB1 OB2.

Sovereign development telemetry, 2026-09-09: Beach pilot OPEN. Correlate source/build/recipe/assets and deployment identity with API/MCP traces, actual selected hardware, load/decode/upload, CPU simulation/physics/AI, GPU passes, frame pacing, resource pressure and recovery. Every metric declares units, scope, timestamps, freshness, provenance, sample/drop counts and measured/estimated/unavailable status. Bound observer cost, retention and cardinality; preserve privacy and user-controlled diagnostic export. Existing OB7/OB8, performance and gameengine owners carry implementation.

Publisher-owned release history and gameplay evidence, 2026-09-09: OPEN - visible API/MCP delivery required. Operator requires retained history for a configurable past interval on affected Compare boards, independent of assistant messages. Compose existing publisher, release records, build receipts and Compare API/MCP surfaces. Retain immutable artifact digests and dependency manifests, full build/test logs, previous release identity, observed served identity and rollback validation. WARC is appropriate for captured HTTP resources; it does not by itself restore databases, execute dynamic worlds or preserve a reproducible build. Keep private source/state and credentials out of public archives. Retention and storage budgets belong to estate configuration; do not silently delete history.

Research bar. WARC preservation reference is measured on HTTP resource archiving with capture metadata. Theirs: ISO WARC. Ours: Proposed companion to existing immutable releases, not implemented here.

Research bar. SLSA build provenance is measured on Build inputs, builder and run provenance tied to artifact identity. Theirs: Provenance specification. Ours: Evaluate mapping existing native build receipts; no compliance claim.

Physics telemetry benchmark programme - 2026-09-09: TARGETS, NOT ACHIEVED. Exceed Chaos Visual Debugger, OmniPVD and MuJoCo on explicitly measured workflows by connecting authored rules, effective per-entity physics, solver results and rendered geometry to the same build and simulation tick. Keep each competitor capability and tested version cited; an untested competitor result is UNKNOWN, never zero. Beach is the first delivered proving scene. Physics validation is shared with gameengine; API/MCP evidence and collection cost belong here.

PT1 - Rule to visible outcome: Target: fully attributable failures. Every tested change records source rule, affected entity set, effective forces/constraints, solver state, render transform and interpolation/origin. Low-gravity expiry and overlapping effects must restore the resolved policy correctly. Check untargeted controls. Pass requires all expected transitions in a versioned fixture suite and deliberate faults detected; numerical tolerances are declared per solver/timestep and fixture, not universal constants.

PT2 - Numerical and visual correctness: Target: independent checks agree. Analytical jump/drop references, timestep convergence, contact and constraint residuals, grounded-foot and rooted-plant support, attachment transforms and penetration depth. Detect intentionally injected terrain-cache, teleport and detached-mesh faults with measured recall and false-alarm rate; legitimate jumps/swimming/flight must not be misclassified. Pixel evidence and solver evidence must be independently collected.

PT3 - Reproduction and diagnosis: Target: one evidence record to replay. A failure links seed, input sequence, source/build/asset digests, effective configuration, hardware and bounded before/after traces. Measure time to reproduce and identify cause against matched workflows in the three reference tools. Distinguish deterministic same-runtime replay from cross-platform numerical equivalence; neither screenshots nor an animation recording prove resumable simulation.

PT4 - Sovereign access and privacy: Target: UI, API and MCP agree. The same evidence identifier and verdict are available from the existing Compare board, documented API and MCP. Local capture and user-controlled export; no proprietary source or private traces in public archives. Verify withheld data, missing capabilities, stale records and permission failures remain explicit.

PT5 - Observer cost and scale: Target: measured Pareto improvement. Compare telemetry off/on at fixed scene, input, resolution, selected adapter and renderer; report p50/p95/p99 frame cost, physics cost, memory, bytes per simulated second, dropped samples and capture coverage. Test available Intel and RTX hardware, increasing entity counts and supported VR modes. Publish raw runs and uncertainty; no superiority claim from unequal coverage or a single warm run.

PT6 - Retained release evidence: Target: rollback is exercised. Publisher emits dated release/build/test history and stable digest references into existing Compare surfaces. Verify previous artifact restoration in an isolated deployment, dependency completeness and schema compatibility. Optional WARC preserves public HTTP captures; native state snapshots and replay manifests carry simulation recovery. Retention, quotas and history tiers are configuration-owned; preserve private history and expose evidence freshness.

Research bar. Chaos Visual Debugger physics benchmark is measured on Recorded physics playback and inspection. Theirs: Documented capability; matched timings unmeasured. Ours: PT1 PT2 PT3.

Research bar. NVIDIA OmniPVD physics benchmark is measured on Visual and quantitative recorded scene inspection. Theirs: Documented capability; matched timings unmeasured. Ours: PT1 PT2 PT3 PT5.

Research bar. MuJoCo numerical benchmark is measured on Solver diagnostics and physics-state inspection. Theirs: Documented capability; matched timings unmeasured. Ours: PT1 PT2 PT5.

Publisher independent review 2026-09-12: Private qualified; canonical adoption in progress, not deployed. Root read the full 26159-byte exact diff and 16245-byte qualification packet for the receipt transaction: 21/21 native transaction and 9/9 subprocess emitter checks. Review found an allocation-failure leak where the transaction ID could be allocated before a failed transaction allocation was checked; correction requested before adoption. Live journal independently remains 1048588 bytes; canonical and scoped publisher sources remain 75361 bytes at this observation. Preserve history; no live archive reset authorized by this review. Shared dependency compatibility and Beach VM candidate audit delegated in parallel. Manual incomplete-intent reconciliation and absent automatic retry dedup remain explicit limitations, not dependable recovery claims.

Arbitrary capacity recurrence, operator 2026-09-12: Observed class; not estate-wide resolved. Canonical VM metadata now sizes export/type/function tables from validated module counts, with fresh-compiled actual Beach plain/shared checks50/50 job1789239799. Root inspected remaining wm_new fixed locals/value/control allocations and wm_call cumulative locals write path: per-function metadata limits do not establish cumulative recursive-frame safety. Track this as a separate unresolved executor-capacity audit, not solved by metadata adoption. Capacity inventory must distinguish binary-format constraints, physical resource availability, configurable user/resource policy, and unexplained implementation constants; record owner, units, basis, growth behavior, boundary tests and observed failure. Growing a table requires overflow-safe arithmetic, preserved live state, accountable allocation failure and appropriate resource admission; replacing one arbitrary number with a larger one is not completion. Extend existing scanner/compiler/Compare owners with measured coverage and counterexamples; lexical matches alone remain candidates, never semantic coverage or frontier qualification. Prioritize limits blocking Beach delivery and repeatable swarm work.

Release 2026-09-12: durable publisher promoted: Live tools updated; served domain verification follows. Both existing publisher aliases promoted with expected SHA and prior binaries retained: scoped230600B cf0fefaa23d3ac6fb8bc6802071d2a55c0f345fee712a06bb10bac1ac8c15969 job1789240268; canonical230584B5062a6a0aa9b97acd7d11201eef1f5131a6830d65bb77108ed730a272eb8a643 job1789240269. Canonical21/21 transaction and12/12 emitter/finalizer checks passed. Reviewed content-loss exception removes obsolete ceiling/false-success diagnostics and replaces the old receipt function; catalogue uncertainty caveats strengthened, not removed. Each artifact now requires durable intent before publishing and checked completion, with explicit failure after a visible rename. No automatic crash replay; no live archive reset. Earlier private status rows are dated history, superseded for these publisher binaries by this release record. Full receipts retained in knowledge/gates/compare-receipt-source-adoption-20260912.json and compare-receipt-promotion-loss-review-20260912.json.

Served release follow-up 2026-09-12: Scoped publication and bounded browser review verified. Actual run1789240299 published Observability API21620B and HTML133552B, appended two rows past journal1048588B with audit_failures0 and published_evidence_incomplete0. Root reviewed settled screenshot and release text at https://nishifamily.com/compare/observability/ . After a first navigation test timed out and reset the tool kernel, a fresh existing Playwright adapter session clicked the actual #delivery-evidence link and verified matching hash, scrollY13282 and section heading; review browser closed. No full-page/device accessibility or full-estate freshness claim. This resolves the bounded navigation gap recorded in compare-publisher-served-release-20260912.json while retaining its earlier observation.

Estate evidence progression release 2026-09-12: Live collector snapshot, with explicit limits. The structured measurements below project the retained canonical run. Historical execution does not establish current artifact acceptance. The dated worklog preserves what changed and what remains open.

Estate evidence measurements

Scope: every matrix file in buildroot/knowledge/compare, including candidates and fixtures. This is a directory population, not a count of registered products.

Estate evidence measurements
Measure	Count / eligible files	Meaning and limits
Gate declarations	89 / 119 files	Files with syntactic gate declarations; execution is not implied.
Coherent retained records	105 / 119 files	Structurally valid historical verdict records; current artifacts are unbound.
Missing records	14 / 119 files	No verdict file in the explicitly selected stamp directory.
Recorded execution	88 / 119 files	Retained record reports one or more runs; not current acceptance.
Recorded all-green runs	85 / 119 files	Historical record only; not proof that the current artifact passes.
Current artifact binding unknown	119 / 119 files	No retained source/artifact binding in this collector schema.
Matrix format unknown	2 / 119 files	Files with unrecognized matrix rows; not a product failure count.

Unknown gate declarations: 0
Invalid / unreadable retained records: 0 / 0
Evidence age at observation: 20759 to 975519 seconds. No freshness cutoff applied.
Observation window (Unix seconds): 1789245487 to 1789245487
Gate / verdict scope: knowledge/compare / knowledge/status
Current artifact binding: unknown: stamp does not retain current matrix/source identity
Served acceptance in this snapshot: not measured
Retained evidence: knowledge/gates/estate-evidence-progression-canonical-20260912.json
SHA256 f8573e0903e27ab660fad9f982cc5a191e7b8ef6e416aac88924c03db82e6cdb

Next evidence increment: estate-wide freshness: OPEN, not included in this release. Reuse nx_evidence_fleet with existing catalogue, build provenance, configured-artifact, runtime-identity and served-evidence owners to join source -> qualified build -> configured artifact -> running identity -> served acceptance. Record drift separately from unavailable identity and policy-stale evidence, with observation age and domain-owned freshness policy. Newer or installed artifacts are not automatically qualified, selected or running. Concrete historical 2026-09-12 bridge observation: configuration selected a3440d81 while installed 560d759a initialized in an owned probe and the attached transport remained closed; subsequent bridge qualification and configuration work is tracked independently. No estate-wide completeness claim until eligible entities, alias resolution, input coverage and unknown edges are measured. Compare the observed chain against an explicitly qualified desired version and compatibility contract, not the newest timestamp. Retained bridge follow-up: knowledge/gates/mcp-bridge-qualified-config-20260912.json verifies the 560d759a configuration readback and recovery probe; it does not prove source-to-artifact lineage or reopen the current attached transport. Expose the first divergent or unknown edge, accountable owner, impact and next native repair or qualification action. Measure eligible inventory coverage, verified chain coverage, drift count and unknown count with explicit denominators; do not count missing observations as current. A bounded two-consumer freshness incident is retained at knowledge/gates/estate-renderer-freshness-incident-20260912.json: qualified matrix 7d730589 and SOTA 6b118f6a were selected by reviewed source and gates, not timestamps. Matrix buildroot/_offc initially remained ecf55dee despite a successful serving-root mirror receipt; existing nx_restage with explicit buildroot resolved the actual fork edge. SOTA promotion first refused content loss and required exact source mapping before its targeted approval. Restage jobs 1789248545/1789248546 were independently verified at the actual buildroot fork paths by hashes 1789248556/1789248557; new running and served identities remain unknown until scoped publication and browser review. This incident denominator is two named consumers, not the estate; observation times and open evidence are in the retained receipt.

Release 2026-09-12: selected dependency guard: Live native API; one dependency checked. Existing nx_comparestale and nx_site_publish now share a dependency checker. The publisher verifies the consumer buffer and one explicitly selected registered release before placement; a live Beach retry checked its shared module and performed zero writes. Complete dependency coverage, runtime compatibility and Beach visual acceptance remain separate. Receipt: knowledge/gates/estate-selected-edge-live-release-20260912.json.

Beach Beta release 2026-09-12: Published and reviewed on the served page. Open https://nishifamily.com/beta/beach . Walking cadence now follows measured clip travel; declared forward-walk actors turn and travel together. Canonical movement72/72 and page26/26 checks passed. Root verified the served revision349e55ad on WebGPU and exercised character framing and performance controls. Grounding and overall visual quality remain poor. Receipt: knowledge/gates/beach-beta-movement-delivery-20260912.json.

Latest recorded release

2026-09-12 · efp_progression

Existing fleet owner now separates gate declarations from retained execution; misleading EXECUTED-EVIDENCE-BACKED wording corrected. Canonical qualification 12/12 includes malformed and duplicate fields, overflow, missing records, a 90000-byte, 5000-row streaming fixture and existing-snapshot refusal. Promoted 78536-byte ELF 34908166bc61c5a9c4396475f79fd52e98c073ee0612b65d37accbe0fe57551b independently hash-verified; actual canonical measurement completed with fsync 0, close 0. Operator registration verified in serving allowlist and schema; no capability scope widened. Optional output creates a new exclusive snapshot, never replaces one. Read-capability discovery omission remains separate. Whole-estate freshness, current source/build/running/served binding and ownership/rework/ROI metrics remain open.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

16 of 20 capability source symbols found|13 of them authored stronger-claims|4 open|coverage 800/1000|adoption 14 full / 2 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 10 vs present 10 · named + unnamed + withheld = 7 vs open 7 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 9165 bytes · gates map: PRIMARY · stamped 35d 1h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_observability.verdict

Gap class	What it is, and the work it names
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence observability itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790082147 domain=observability target_version=- rungs=15 done=8 open=7 finish=1 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
F	FINISH	Shared child reaper (OB0b) dr_drain dossier	LIB-GATE-ONLY importers=1	imported only by validation organs (gates, tests, benches): wire it into a shipping program
#1	later	Connection-churn axis (OB2) _ABSENT_:ioa_connchurn dossier	2600	v=13 m=2 c=10
#2	later	Capacity-aware durable evidence lifecycle (receipt_durability) rg_receipt dossier	1000	v=50 m=2 c=100
#3	later	Two-window burn-rate alerting (OB6) _ABSENT_:slo_burn_rate dossier	700	v=7 m=2 c=20
#4	later	Trace spans across fork and exec (OB8) _ABSENT_:tr_span_ctx dossier	600	v=12 m=1 c=20
#5	later	Observer-cost accounting (OB7) _ABSENT_:ioa_observer_cost dossier	200	v=1 m=2 c=10
#6	later	Incident-to-variant prevention across Nishi source and compiler (OB11) nx_capsearch dossier	0	v=0 m=1 c=100
#7	later	Estate evidence progression observations (efp_progression) efp_progression dossier	0	v=0 m=1 c=100

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Writeback-congestion axis (OB0)	ioa_congestion	Dirty plus Writeback as a steerable level beside the coin-flip procs_blocked sample -- LANDED 2026-09-03, promoted, deliberately UNARMED until a healthy distribution exists	Organ	0 u
Shared child reaper (OB0b)	dr_drain	One reaper composed by every forking daemon instead of sixteen hand-rolled misses -- LANDED 2026-09-03, gate 9 of 9 GREEN and bite-proven	Organ	0 u
A severity that is READ (OB5)	pc_sev_consumer	An actuator that consumes the churn severity procchurn has written on every beat since July. A sensor with no reader is not a feedback loop	Organ	1 u
Block-device axis (OB1)	ioa_diskstats	Sectors written and read, IOPS and ios_in_progress per array from proc diskstats, with the derived throughput that sizes the writeback thresholds	Organ	1 u
Connection-churn axis (OB2) after OB1	_ABSENT_:ioa_connchurn	TIME_WAIT and ESTABLISHED counts by local port and peer, so a localhost connection storm names its own target	Organ	1 u
Foreign-load share (OB3) after OB4	ioa_ownership_census	What fraction of load, forks and blocked processes belongs to processes the estate does not own, published so admission can stop treating a one-sided treaty as a fair one	Organ	2 u
Fork sources by parent (OB4)	pc_fork_by_parent	Attribution of the kernel fork counter to parent processes, with the instrument's own forks subtracted	Organ	1 u
Two-window burn-rate alerting (OB6) after OB1	_ABSENT_:slo_burn_rate	Short plus long window so an action cannot latch after recovery, a bounded action rate, a time-boxed off switch that re-arms, and a minimum denominator so it cannot fire on the empty set	Organ	2 u
Observer-cost accounting (OB7) after OB4	_ABSENT_:ioa_observer_cost	Every sampling instrument reports its own share of what it measured and subtracts it. Measured need: a fork counter that was 66 percent its own forks	Organ	1 u
Trace spans across fork and exec (OB8) after OB2	_ABSENT_:tr_span_ctx	Span context propagated over a fork and an exec boundary so a request crossing organs is one trace	Organ	2 u
The device-mapper cache layer (OB9) after OB1	_ABSENT_:ioa_dmcache	Cache mode, hit and dirty rates, and THE REDUNDANCY STATE OF THE CACHE DEVICE ITSELF, joined into one actionable verdict. Found the hard way: /volume1 ran on an UNMIRRORED write-back cache holding 43 million dirty blocks for 33 days and no organ could see it	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M0 · The loop closes	OB5	1 u
M1 · The box is visible	OB1 OB2	3 u
M2 · Attribution is honest	OB4 OB3 OB7	7 u
M3 · Alerting and tracing	OB6 OB8	11 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Which telemetry nothing reads (OB10)	us_classify	A census of knowledge/status/ artifacts by how many DISTINCT sources name each one, so a sensor shipped with no reader is caught on the day it ships instead of being rediscovered a fifth time. LANDED 2026-09-03, gate 9 of 9, four bite-proven teeth, ratchet self-baselining.	Organ	Uncalibrated u
Capacity-aware durable evidence lifecycle (receipt_durability) after OB1	rg_receipt	DEFINED 2026-09-12 from observed Compare failure. Job1789237922 skipped3 receipts at1048588B against hardcoded1048576B, while measured available storage was20973773664256B (job1789238079); no physical exhaustion. Replace total-file cap and whole-history reads with bounded working memory, checked durable writes, capacity/quota/reserve observations and explicit failure states. Archive must preserve concurrent writes and immutable history; snapshot then truncate is not safe without writer coordination. Critical release evidence may not disappear behind GREEN. Private fixes underway; no deployment claimed. Research contract: knowledge/gates/estate-defect-prevention-research-20260912.json. Reuse existing publisher, archive, resource and config owners.	Workflow	Uncalibrated u
Incident-to-variant prevention across Nishi source and compiler (OB11) after receipt_durability	nx_capsearch	DEFINED 2026-09-12. Convert confirmed failures into invariant + minimized counterexample + source-owner links, then AST/control/data-flow variant queries with scanned/unsupported denominators. Classify protocol bounds, allocation safety bounds, user policy and arbitrary ceilings distinctly; do not delete useful safeguards. Prioritize ignored mandatory results, non-durable success, unchecked write/allocation arithmetic, unsafe concurrent lifecycle and compiler shadowing. Fuzz and fault-inject isolated candidates, model state transitions, prove old defects fail gates, then adopt shared fixes across consumers. Evolutionary search is a candidate generator only after independently protected evaluators and held-out workloads. Track precision, recurrence, escaped severity, mutation sensitivity and accepted outcomes per total supervision cost. Research methods/caveats retained in knowledge/gates/estate-defect-prevention-research-20260912.json.	Workflow	Uncalibrated u
Estate evidence progression observations (efp_progression)	efp_progression	LANDED 2026-09-12: existing nx_evidence_fleet measures explicit matrix-directory coverage, gate declarations, retained verdict structure and record age. Canonical run 1789245486 measured 119 matrix files, including candidates and fixtures. Current artifact binding remains unknown for all 119; historical all-green records are not current acceptance. Full snapshot knowledge/gates/estate-evidence-progression-canonical-20260912.json. Source/build/running/served joins remain OPEN.	Organ	Uncalibrated u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 15. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 3dcd271c406bd98e2f436d08473bceaddea9fbcb4bd088e6ddef398a63a80292. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 15 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

OB0 — Writeback-congestion axis
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ioa_congestion
Acceptance: Dirty plus Writeback as a steerable level beside the coin-flip procs_blocked sample -- LANDED 2026-09-03, promoted, deliberately UNARMED until a healthy distribution exists
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB0b — Shared child reaper
Prerequisites: None declared; this does not establish execution eligibility.
Contract: dr_drain
Acceptance: One reaper composed by every forking daemon instead of sixteen hand-rolled misses -- LANDED 2026-09-03, gate 9 of 9 GREEN and bite-proven
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB5 — A severity that is READ
Prerequisites: None declared; this does not establish execution eligibility.
Contract: pc_sev_consumer
Acceptance: An actuator that consumes the churn severity procchurn has written on every beat since July. A sensor with no reader is not a feedback loop
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB1 — Block-device axis
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ioa_diskstats
Acceptance: Sectors written and read, IOPS and ios_in_progress per array from proc diskstats, with the derived throughput that sizes the writeback thresholds
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB2 — Connection-churn axis
Prerequisites: OB1 (acceptance unverified)
Contract: _ABSENT_:ioa_connchurn
Acceptance: TIME_WAIT and ESTABLISHED counts by local port and peer, so a localhost connection storm names its own target
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB3 — Foreign-load share
Prerequisites: OB4 (acceptance unverified)
Contract: ioa_ownership_census
Acceptance: What fraction of load, forks and blocked processes belongs to processes the estate does not own, published so admission can stop treating a one-sided treaty as a fair one
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB4 — Fork sources by parent
Prerequisites: None declared; this does not establish execution eligibility.
Contract: pc_fork_by_parent
Acceptance: Attribution of the kernel fork counter to parent processes, with the instrument's own forks subtracted
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB6 — Two-window burn-rate alerting
Prerequisites: OB1 (acceptance unverified)
Contract: _ABSENT_:slo_burn_rate
Acceptance: Short plus long window so an action cannot latch after recovery, a bounded action rate, a time-boxed off switch that re-arms, and a minimum denominator so it cannot fire on the empty set
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB7 — Observer-cost accounting
Prerequisites: OB4 (acceptance unverified)
Contract: _ABSENT_:ioa_observer_cost
Acceptance: Every sampling instrument reports its own share of what it measured and subtracts it. Measured need: a fork counter that was 66 percent its own forks
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB8 — Trace spans across fork and exec
Prerequisites: OB2 (acceptance unverified)
Contract: _ABSENT_:tr_span_ctx
Acceptance: Span context propagated over a fork and an exec boundary so a request crossing organs is one trace
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB9 — The device-mapper cache layer
Prerequisites: OB1 (acceptance unverified)
Contract: _ABSENT_:ioa_dmcache
Acceptance: Cache mode, hit and dirty rates, and THE REDUNDANCY STATE OF THE CACHE DEVICE ITSELF, joined into one actionable verdict. Found the hard way: /volume1 ran on an UNMIRRORED write-back cache holding 43 million dirty blocks for 33 days and no organ could see it
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB10 — Which telemetry nothing reads
Prerequisites: None declared; this does not establish execution eligibility.
Contract: us_classify
Acceptance: A census of knowledge/status/ artifacts by how many DISTINCT sources name each one, so a sensor shipped with no reader is caught on the day it ships instead of being rediscovered a fifth time. LANDED 2026-09-03, gate 9 of 9, four bite-proven teeth, ratchet self-baselining.
Authored effort: Uncalibrated. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
receipt_durability — Capacity-aware durable evidence lifecycle
Prerequisites: OB1 (acceptance unverified)
Contract: rg_receipt
Acceptance: DEFINED 2026-09-12 from observed Compare failure. Job1789237922 skipped3 receipts at1048588B against hardcoded1048576B, while measured available storage was20973773664256B (job1789238079); no physical exhaustion. Replace total-file cap and whole-history reads with bounded working memory, checked durable writes, capacity/quota/reserve observations and explicit failure states. Archive must preserve concurrent writes and immutable history; snapshot then truncate is not safe without writer coordination. Critical release evidence may not disappear behind GREEN. Private fixes underway; no deployment claimed. Research contract: knowledge/gates/estate-defect-prevention-research-20260912.json. Reuse existing publisher, archive, resource and config owners.
Authored effort: Uncalibrated. Executor kind: Workflow. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
OB11 — Incident-to-variant prevention across Nishi source and compiler
Prerequisites: receipt_durability (acceptance unverified)
Contract: nx_capsearch
Acceptance: DEFINED 2026-09-12. Convert confirmed failures into invariant + minimized counterexample + source-owner links, then AST/control/data-flow variant queries with scanned/unsupported denominators. Classify protocol bounds, allocation safety bounds, user policy and arbitrary ceilings distinctly; do not delete useful safeguards. Prioritize ignored mandatory results, non-durable success, unchecked write/allocation arithmetic, unsafe concurrent lifecycle and compiler shadowing. Fuzz and fault-inject isolated candidates, model state transitions, prove old defects fail gates, then adopt shared fixes across consumers. Evolutionary search is a candidate generator only after independently protected evaluators and held-out workloads. Track precision, recurrence, escaped severity, mutation sensitivity and accepted outcomes per total supervision cost. Research methods/caveats retained in knowledge/gates/estate-defect-prevention-research-20260912.json.
Authored effort: Uncalibrated. Executor kind: Workflow. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
efp_progression — Estate evidence progression observations
Prerequisites: None declared; this does not establish execution eligibility.
Contract: efp_progression
Acceptance: LANDED 2026-09-12: existing nx_evidence_fleet measures explicit matrix-directory coverage, gate declarations, retained verdict structure and record age. Canonical run 1789245486 measured 119 matrix files, including candidates and fixtures. Current artifact binding remains unknown for all 119; historical all-green records are not current acceptance. Full snapshot knowledge/gates/estate-evidence-progression-canonical-20260912.json. Source/build/running/served joins remain OPEN.
Authored effort: Uncalibrated. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence observability writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

OB0 Writeback-congestion axis · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ioa_congestion` · executor Organ · 0 u · stands on nothing
Definition of done	Dirty plus Writeback as a steerable level beside the coin-flip procs_blocked sample -- LANDED 2026-09-03, promoted, deliberately UNARMED until a healthy distribution exists
Matrix cell	CONGESTION: writeback backlog as a LEVEL you can steer on · `runtime/nx_ioadmit_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land Writeback-congestion axis ioa_congestion landed in nx_ioadmit_lib: Dirty plus Writeback read from proc meminfo with the keys carrying their COLONS, because WritebackTmp: would otherwise answer for Writeback: and the wrong number would be confident rather than absent. Ships INERT (bars at 0 in knowledge/ioadmit.conf, UNCALIBRATED) so it can report and cannot yet refuse.

OB0b Shared child reaper · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dr_drain` · executor Organ · 0 u · stands on nothing
Definition of done	One reaper composed by every forking daemon instead of sixteen hand-rolled misses -- LANDED 2026-09-03, gate 9 of 9 GREEN and bite-proven
Matrix cell	HYGIENE: shared child reaper so a fork-per-request server cannot leak · `runtime/nx_daemon_reap_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_daemon_reap_lib`; declare `nx_daemon_reap_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land Shared child reaper nx_daemon_reap_lib landed (dr_reap_nonblocking, dr_reap_one, dr_drain, dr_throttle) after nx_capsearch over 7264 organs with corpus_complete=1 proved no such primitive existed. Gate 12 of 12 GREEN, whole-gate mutation bite killed=1. The WNOHANG discriminator forks a real live child and asserts the drain does not block on it, then that the same child is still collected once it exits.

OB5 A severity that is READ · cell PRESENT · gate NO-GATE-DECLARED

Contract	`pc_sev_consumer` · executor Organ · 1 u · stands on nothing
Definition of done	An actuator that consumes the churn severity procchurn has written on every beat since July. A sensor with no reader is not a feedback loop
Matrix cell	LOOP: a severity that is actually READ by an actuator · `runtime/_hdl_build/nx_procchurn_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_procchurn_lib`; declare `nx_procchurn_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 measure The severity had been correct and unread for 35 days. procchurn.jrnl has carried sev= on every frame since 2026-07-30 and no organ in the estate had ever read that field. The two live frames taken while building this both read sev=2 with blocked=7 and blocked=14 against an 8-core box, so a correct RED was on disk throughout the storm this session opened on. 2026-09-03 land pc_sev_consumer landed with pc_sev_last, pc_find_in, pc_int_at, pc_isdig and pc_act_name. Gate 29 of 29, fourteen bite-proven teeth of which seven are new. Promoted: gate 43b648f1, organ 8d6893c3, both _offc twins refreshed. Proven live on the real wire and not only in fixture: act=DEFER read=FRAME disk_sev=2 age_s=0 max_age_s=6 bar=DERIVED-from-window, receipt truncate-written to knowledge/status/procchurn.act. 2026-09-03 lesson A SENSOR WHOSE SEVERITY NO ACTUATOR CONSUMES CANNOT CHANGE AN OUTCOME, AND FROM ANY DASHBOARD IT IS INDISTINGUISHABLE FROM ONE THAT IS WORKING. The gap was not a missing threshold, it was a missing READER. Three shapes were carried into the fix: read the field OFF DISK not out of the producer live variable, because the wire is where two organs each correct in isolation still disagree; make every way of being blind return UNOBSERVABLE and never PROCEED, including UNARMED, because an unarmed guard that proceeds is byte-for-byte indistinguishable from no guard; and TRUNCATE-write the receipt, because a check that greps an append-only journal is vacuously green forever. 2026-09-03 lesson The staleness bar is DERIVED from the measurement window rather than picked, and its provenance is printed on every line. Two windows leaves a full window of margin, so the only thing that can blow the bar is a frame this run did not write -- which is exactly the silently-failed-append condition the freshness check exists to catch. A number chosen to make the teeth pass would have tested nothing. 2026-09-03 queue The WHOLE-GATE mutation bite is UNPROVEN, not passed: nx_gate_bite returned BUILD-REFUSED-BY-ADMISSION (exit=6), so nothing was compiled and no claim is made about it. The fourteen gv_bite teeth are proven both polarities by construction; the harness proof is owed and is one re-run away when load clears. 2026-09-03 retract A claim made earlier in this same session is withdrawn: I reported that the C6 conjunct2 gap needed a new `nx_sota_status why <domain>` verb and filed a design for it. THERE IS ALREADY A REGISTERED TOOL CALLED nx_sota_why, LIVE on the MCP surface -- source, built, promoted, registered, authorised and INVOKED -- and nx_capsearch would have named it. That is a retrieval failure, not a discovery. What the measurement then showed is worse than a duplicate: nx_sota_why is an ALIAS of nx_sota_status (identical 56,557 B source and 125,712 B binary; no file named nx_sota_why exists anywhere under nishihost, find exit 0 no results), so it inherits an argv-ignoring main. Called with a domain name it prints the whole estate aggregate and says nothing about that domain. A NAME THAT PROMISES A CAPABILITY ITS BINARY DOES NOT HAVE IS WORSE THAN THE MISSING CAPABILITY, because the registry entry reads as coverage and stops anyone looking. 2026-09-03 lesson nx_catalog reported SOURCE yes 56557B / BUILT yes / PROMOTED yes 125712B for nx_sota_why while no such file exists under this root. It is a STAT-BASED catalogue following a registry alias, so it answered about the target and named the alias. A STAT THAT FOLLOWS AN ALIAS CANNOT TELL YOU WHETHER THE THING YOU ASKED ABOUT EXISTS -- only whether something it points at does. 2026-09-03 land The fix chosen was NOT a why-verb. This board already walks all 110 domains and prints each one class into a bucket, then makes only the estate total durable -- which is exactly why C6 reports UNEVALUABLE for every domain: A VERDICT THAT IS PRINTED BUT NOT PERSISTED CANNOT BE AGREED WITH, DISPUTED, OR REGRESSED AGAINST. nx_sota_status now truncate-writes knowledge/status/sota_board.ledger, one row per domain carrying class plus the numbers the class was derived from, ending in a partition that SUMS and a reconciliation line that checks the ledger classes against the separately-computed printed buckets. One extra file write in a walk that was already happening answers all 110 domains at once, and no existing caller changes by a byte. 2026-09-03 land C6 producer side landed and PROMOTED: nx_sota_status 131144 B sha 5ebf1da7 now truncate-writes knowledge/status/sota_board.ledger. Live reading reconciles GREEN -- proven=0 red=0 mech_ok=77 claim_only=27 unproven=6 sum=110 domains=110, matching the printed buckets exactly. observability itself reads class=MECH-OK cov=789 exceed=12 gaps=4. 2026-09-03 land And the consumer the name had been promising for weeks: nx_sota_why is now a REAL organ (26515 B sha 9413f78a) with nx_sota_why_gate at 14 of 14 GREEN on the NAS, four teeth bite-proven. It answers WHERE ONE DOMAIN STANDS and WHAT THE ONE NEXT STEP IS, reading the ledger and re-deriving nothing. Five refusals each carry their own exit code: absent ledger, capped ledger, self-inconsistent ledger, stale ledger, unknown domain -- because a fact about the EVIDENCE and a fact about the ARGUMENT have opposite remedies and must never share an exit. 2026-09-03 lesson ITS OWN GATE CAUGHT THREE OF MY DEFECTS BEFORE ANY OF THEM SHIPPED, AND THE MOST IMPORTANT ONE WAS IN A GUARD. The no-silent-cap check tested n >= SW_CAP, but rm_read reads at most cap-1 and NUL-terminates, so a fully truncated read returns exactly cap-1 and the guard COULD NEVER FIRE -- the no-silent-cap check was itself silent. It was caught only because the tooth is PAIRED: a fixture-reached tooth proving the fixture really exceeded the cap, beside an outcome tooth proving the organ noticed. A CAP GUARD MUST BE WRITTEN AGAINST THE READER ACTUAL FULL-CAP SIGNAL, NEVER AGAINST THE CAP YOU HANDED IT; the two differ by whatever that reader reserves and the difference is invisible. The other two were a hand-guessed row-end constant (34, really 33) and a fixture 5 KB short of the bar it was meant to exceed -- both caught by fixture-reached teeth, both of which would otherwise have read as bugs in the subject. 2026-09-03 queue BUILT AND UNWIRED ON THE MCP SURFACE, NAMED RATHER THAN GLOSSED. /api/tools/register is idempotent BY NAME ONLY -- it returns ALREADY-REGISTERED and keeps the old elf -- and nx_toolreg_reconcile only registers MISSING rows, so the MCP name nx_sota_why still routes to nx_sota_status.elf. Direct exec of ./nx_sota_why.elf <domain> works today. Debt 1788477358 sev 6 carries the unblock condition (a re-point verb on the mgmt API). NOT attempted in-session on purpose: that deploy restarts the transport every concurrent seat calls through, there is an open bind race on it, the box is in a measured I O storm, and a sibling seat is live. A REDISCOVERY, NOT A NEW FINDING: an EATEN row from 2026-07 already recorded that /api/tools/register REFUSES update -- the row was closed and the defect was not, which is exactly how a defect gets independently rediscovered at cost.

OB1 Block-device axis · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ioa_diskstats` · executor Organ · 1 u · stands on nothing
Definition of done	Sectors written and read, IOPS and ios_in_progress per array from proc diskstats, with the derived throughput that sizes the writeback thresholds
Matrix cell	DEVICE: block throughput and queue depth from diskstats · `runtime/nx_ioadmit_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land Block-device axis landed: ioa_ds_parse is PURE over a buffer so its teeth run on fixture bytes, ioa_diskstats is a thin reader owning the file and the cap, and ioa_sector_rate_kbs TAKES A DELTA. That signature is the guard: a cumulative counter cannot be handed to it and published as throughput. Device matching is exact -- the fixture puts md40 BEFORE md4 so a prefix matcher fails.

OB2 Connection-churn axis · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:ioa_connchurn` · executor Organ · 1 u · stands on OB1
Definition of done	TIME_WAIT and ESTABLISHED counts by local port and peer, so a localhost connection storm names its own target
Matrix cell	NETWORK: connection-churn axis, TIME_WAIT and accept rate · `runtime/nx_ioadmit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

OB3 Foreign-load share · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ioa_ownership_census` · executor Organ · 2 u · stands on OB4
Definition of done	What fraction of load, forks and blocked processes belongs to processes the estate does not own, published so admission can stop treating a one-sided treaty as a fair one
Matrix cell	ATTRIBUTION: what share of host load is NOT OURS · `runtime/nx_ioadmit_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land Ownership attribution landed: ioa_ownership_census partitions BOTH the process population AND the blocked roster into ours and foreign, and ioa_share_permil ABSTAINS on an uncountable population rather than rendering 0 permil. Gate 36 of 36 with five bite-proven teeth. Promoted be5ac814, live and re-run GREEN. 2026-09-03 retract A claim this session published hours earlier -- that the box is dominated by foreign load -- was CORRECTED BY THE INSTRUMENT BUILT TO TEST IT. First live reading: procs=792 ours=107 foreign=685 foreign_permil=864, and yet blocked=5 with blocked_ours=4. Second reading minutes later: blocked=9 blocked_ours=9 blocked_foreign=0. The POPULATION is 85 to 86 percent foreign while the BLOCKED ROSTER, which is the only thing ba_verdict actually reads, is 80 to 100 percent OURS. Population, fork rate and blocked roster are three different subjects that give three different answers, and a session that slides between them will publish whichever flatters its story.

OB4 Fork sources by parent · cell PRESENT · gate NO-GATE-DECLARED

Contract	`pc_fork_by_parent` · executor Organ · 1 u · stands on nothing
Definition of done	Attribution of the kernel fork counter to parent processes, with the instrument's own forks subtracted
Matrix cell	ATTRIBUTION: fork sources by PARENT, not by survivor sampling · `runtime/_hdl_build/nx_procchurn_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_procchurn_lib`; declare `nx_procchurn_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 queue Next rung, and the incumbent question is already settled: do NOT hand-roll a proc stat parser. nx_dstate.ds_field_from_state already parses fields ANCHORED PAST THE COMM PARENS, which is the trap (a comm can contain spaces and parentheses), and nx_ctxtop_lib already walks proc per-process with its own admission check. The honest shape for OB4 is to extract that parser into a lib both callers share, and to publish attributed forks as a LOWER BOUND against the kernel counter -- a pid diff measures SURVIVORS, and the short-lived majority is the churn. 2026-09-03 land pc_fork_by_parent landed with pc_pids, pc_pid_seen, pc_ppid_of, pc_tally_parent and pc_attrib_permil, wired into nx_procchurn on every beat. Gate 42 of 42 with twenty bite-proven teeth. Live first run: new_survivors=6 attributed=6 distinct_parents=3 vanished_before_read=0 kernel_forks=35 coverage_permil=171 pids_seen=769 cap_hit=0, naming three parent pids and what each spawned. 2026-09-03 measure COVERAGE 171 PERMIL IS THE FINDING, NOT A DEFECT. In that window the kernel forked 35 processes and the survivor census could account for 6 of them. The other 29 lived and died inside 3 seconds. That is the whole argument of this rung expressed as a number on the live host, and it is why the attributed count is printed as forkattrib=LOWER-BOUND beside kernel_forks rather than as a rate. 2026-09-03 lesson THE COST BUDGET CHANGED THE DESIGN, AND IT ONLY DID SO BECAUSE IT WAS COMPUTED BEFORE THE CODE. My first instinct was to hide the walk behind a severity check, reasoning that a per-process walk on a storming box is the diagnostic-becomes-the-load defect. Then I counted: enumeration is getdents on /proc, a handful of syscalls at ANY process count, and only NEW pids get a stat read -- about 50 syscalls per beat against the 2300 a full walk would cost. The switch was unnecessary and would have made the instrument blind exactly when it matters. BUDGET THE COMPLEXITY BEFORE WRITING, NOT AFTER, BECAUSE THE ANSWER CHANGES WHAT YOU BUILD. 2026-09-03 retract A first draft of pc_ppid_of read /proc/<pid>/status and parsed PPid: itself. It would have worked. It was still the duplicate-ruler defect, written in the same session in which I recorded the law against it twice. The estate has exactly ONE /proc/<pid>/stat parser, ioa_stat_parse, which spans comm from the first paren to the LAST one because a comm may contain spaces and parentheses; the shipped pc_ppid_of is a named accessor for its ppid slot and adds no parsing. CHECK-BEFORE-BUILD APPLIES TO THE FUNCTION YOU ARE ABOUT TO WRITE, NOT ONLY TO THE ORGAN, and the check that caught it was reading the incumbent lib rather than trusting my own memory of it. 2026-09-03 lesson The consolidation direction is fixed by the import graph and had to be recorded so nobody 'fixes' it the wrong way: nx_ctxtop_lib carries ct_find, which is pc_pid_seen under another name, but nx_ctxtop_lib IMPORTS nx_procchurn_lib, so the cycle is not resolvable upward. pc_pids is the landing place for that consolidation -- a pid enumerator with nothing else in it -- and ioa_ownership_census and ioa_count_comm_mode both bake enumeration into their classification so neither can lend it out today. 2026-09-03 lesson THE LAPTOP BUILD FARM IS THE ANSWER WHEN ADMISSION REFUSES EVERYTHING, AND IT WORKED END TO END TODAY. After ten paced refusals at procs_blocked 8 to 10 the nx_sota_why pair was built on the laptop under WSL with no governor, gate-run there, then shipped to the NAS and promoted with hashes verified byte-identical on both sides. The recorded precondition held and was checked, not assumed: the laptop closure was BEHIND the NAS on five files, so the NAS copies were adopted after a size and date diff rather than blindly, since a laptop build of a NAS-ahead source is the AHEAD class wearing a fresh timestamp.

OB6 Two-window burn-rate alerting · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:slo_burn_rate` · executor Organ · 2 u · stands on OB1
Definition of done	Short plus long window so an action cannot latch after recovery, a bounded action rate, a time-boxed off switch that re-arms, and a minimum denominator so it cannot fire on the empty set
Matrix cell	ALERT: two-window burn-rate with a bounded action rate · `runtime/nx_ioadmit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

OB7 Observer-cost accounting · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:ioa_observer_cost` · executor Organ · 1 u · stands on OB4
Definition of done	Every sampling instrument reports its own share of what it measured and subtracts it. Measured need: a fork counter that was 66 percent its own forks
Matrix cell	HONESTY: an instrument that reports its OWN share of the measurement · `runtime/nx_ioadmit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

OB8 Trace spans across fork and exec · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:tr_span_ctx` · executor Organ · 2 u · stands on OB2
Definition of done	Span context propagated over a fork and an exec boundary so a request crossing organs is one trace
Matrix cell	TRACE: spans with context propagation across a fork or exec boundary · `runtime/nx_ioadmit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-09 queue 2026-09-09 operator: comprehensive SOTA telemetry especially for sovereign development. Standards checked: OpenTelemetry overview and metrics data model, W3C Trace Context. Use interoperable semantics and export with estate-owned collection/storage/control. Current Beach gaps include uncounted draws, latest-only GPU sample, browser-inaccessible GPU memory and no complete request-to-frame trace. Actual adapter telemetry is qualified separately; end-to-end coverage remains open. 2026-09-09 queue 2026-09-09 operator also requires autonomous movement and visual-fault telemetry: correlate absolute/local entity coordinates, origin shifts, tick/input, ground contact and rendered attachment evidence with release identity. Detect uncommanded warps, resets, floating or penetrating bodies/props/plants and detached hair/clothes; expected transitions must be explicit and screenshots alone cannot establish physics correctness. Capture bounded replay windows and dropped-sample/observer-cost evidence. Current implementation and public board refresh remain unverified. 2026-09-09 queue 2026-09-09 operator explicitly requested a telemetry Compare board and targets exceeding the three physics-debugging references. Existing observability board is the owner; PT1-PT6 above define acceptance evidence, not implemented features or benchmark wins. Native and served-Wasm terrain-cache tests now detect a real Beach fault and validate its correction; full runtime anomaly collection and public history remain open.

OB9 The device-mapper cache layer · cell LANDED · gate NO-GATE-DECLARED

Contract	`_ABSENT_:ioa_dmcache` · executor Organ · 1.5 u · stands on OB1
Definition of done	Cache mode, hit and dirty rates, and THE REDUNDANCY STATE OF THE CACHE DEVICE ITSELF, joined into one actionable verdict. Found the hard way: /volume1 ran on an UNMIRRORED write-back cache holding 43 million dirty blocks for 33 days and no organ could see it
Matrix cell	CACHE: the device-mapper layer between the filesystem and the array · `runtime/nx_ioadmit_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 retract The rung text above states the cache held 43 million dirty blocks for 33 days. MEASURED 2026-09-03 and WITHDRAWN. dirty_write_hits is a LIFETIME COUNTER, not a level. cache_info reads dirty_blocks=0 and flashcache_progress reads status=uncacheable_flush_done with initial_num_of_dirty=0 and remaining_num_of_dirty=0. NO DATA WAS EVER AT RISK. A frozen counter and a pinned level are indistinguishable in one sample, and the alarming reading is the one that gets published. The seat that wrote this rung and the seat correcting it made the same error hours apart. 2026-09-03 measure Two spaced samples of flashcache_stats on the live host: writes +18366 equals disk_writes +18366 equals uncached_writes +18366, and reads +12546 total against only +35 cache hits, with every SSD-side counter frozen. The cache is FLUSHED AND DISABLED, so 100 percent of I O goes direct to the RAID5 array. mdstat reads md3 active raid1 nvme1n1p1 at 2 of 1 with nvme0n1 ABSENT. That is the entire mechanism of the day-long build-refusal storm, and the remedy is PHYSICAL rather than a build defect. 2026-09-03 land nx_cachewatch and nx_cachewatch_gate written and PROVEN ON THE LAPTOP ONLY. 8 of 8 GREEN with four distinct verdict states, bite-proven killed=1, source and deployed subject both restored byte-identical. Sources landed on the NAS at 13306 and 12037 bytes. NOT BUILT ON THE NAS. Build admission refused every attempt at load 13 to 25, which is the storm this rung exists to detect. 2026-09-03 lesson mode is NOT the discriminator. cache_info keeps printing mode=WRITE_BACK after the cache has been flushed and disabled, because that field records how the device was CONFIGURED rather than whether it is caching now. The live signal is flashcache_progress status=uncacheable. Gate tooth T2 makes this decidable by requiring two fixtures with BYTE-IDENTICAL cache_info to return DIFFERENT verdicts, so an organ keyed on mode fails that tooth and passes every other one. 2026-09-03 queue CONVERGENCE OWED, AND NAMED AS MY OWN MISS. This rung declares the symbol ioa_dmcache inside nx_ioadmit_lib, and I built a STANDALONE nx_cachewatch without reading the rung first. The capability is right and its home is wrong, which is the duplicate-ruler shape. Close the contract at its DECLARED home by composing the proven logic into ioa_dmcache, then keep nx_cachewatch as the CLI and gate around that symbol or retire it reversibly. DO NOT flip this rung on the standalone organ. 2026-09-03 queue Also owed before this rung can be trusted in production. The gate is proven on the laptop only, and gateroster.conf requires NAS evidence through /api/gate_run for a hand-added row, so no roster row was added. Build both on the NAS, run the gate there, then admit the row with its evidence line. 2026-09-03 measure 2026-09-03 THE DEAD SUPERVISOR /status IS NOT COSMETIC -- IT IS A BOOTSTRAP DEADLOCK THAT BLOCKS ITS OWN REPAIR. nx_daemon_supervisor is DECLARED a daemon, so /api/promote correctly refuses it by name (refusal=DECLARED-DAEMON) and routes it to the health-checked /api/deploy, whose contract is validate then promote then http-health then auto-rollback. The supervisor's health surface IS /status on 127.0.0.1:18095, and that endpoint refuses connections (debt 1788393501). The code that serves it is a forked child of the supervisor, so THE FIX FOR THE HEALTH CHECK SHIPS INSIDE THE BINARY THE HEALTH CHECK MUST VALIDATE. Firing /api/deploy today would promote, fail the probe, and auto-roll-back -- a kill and respawn of the process keeping 44 daemons alive, during a measured I/O storm, for zero net change. The guard fix is BUILT AND STAGED and safe to leave staged: nx_daemon_supervisor.sov.elf.new 77544 bytes sha ea45f035, src_path verified, src_stable=1, nx_contentdiff GREEN over 231 runs with lost_from_live=0. 2026-09-03 lesson A DAEMON WHOSE ONLY HEALTH SURFACE IS SERVED BY ITSELF CANNOT BE SHIPPED BY A HEALTH-CHECKED LANE ONCE THAT SURFACE DIES -- the deploy gate and the defect are the same process, so the safety mechanism becomes the thing preventing the repair. This is the static-stability violation the estate already records for the control plane, arriving one layer down: the undo path traverses the subject. Two ways out and both are declarations rather than code: give the deploy row a health probe that does NOT live inside the subject (the parent guard nx_hostctl hc_guard_dsup is alive at pid 6558 and observes it from outside), or take an operator window for a deliberate restart. Choosing neither silently is how a staged safety fix becomes indistinguishable from abandoned junk. 2026-09-03 measure 2026-09-03 THE SUPERVISOR WAS HEALTHY THE WHOLE TIME AND ITS DEAD /status IS WHY THAT TOOK AN HOUR TO ESTABLISH. Measured directly: nx_math_serve.elf pid 7187 parent 631 etimes 3173, launched by the supervisor from its signed daemons.reg row and serving in 1.45 ms, while five successive hypotheses were built about why the supervisor would not launch it. With /status answering, ONE call would have listed the fleet and ended the investigation at the first minute. The cost of an unobservable supervisor is not measured in the incidents it hides but in the investigations it forces. 2026-09-03 retract 2026-09-03 THE BOOTSTRAP DEADLOCK I JOURNALED EARLIER TODAY IS FALSE AND IS WITHDRAWN. I wrote that nx_daemon_supervisor could not ship through the health-checked lane because its /status on 18095 was dead and the fix shipped inside the binary the health check must validate. /status WAS NEVER DEAD. Measured: netstat shows 127.0.0.1:18095 LISTEN held by the status child, that child sits in inet_csk_accept, and curl returns HTTP 200 with cycle=1186 integrity=signed. The discriminating experiment was a client with no argv grammar to get wrong. What actually blocked the deploy was mundane and fixable in one line: nx_daemon_supervisor had NO ROW IN deploy_targets.conf, so /api/deploy answered unknown target. Debt 1788393501's claim that /status serves an 83 byte empty body is stale on this evidence and should be re-derived before anyone acts on it. 2026-09-03 lesson I PRODUCED THE SAME FALSE DEATH CERTIFICATE TWICE FROM THE SAME CAUSE, THE SECOND TIME AFTER I HAD ALREADY DIAGNOSED AND FIXED THAT CAUSE. nx_http_probe takes path then expect then port and has NO host argument; called host-first it probes port 0 and answers connect-failed. That produced a false /math is down (five wrong hypotheses against a service that had been serving 53 minutes) and then a false /status is dead (a fabricated architectural deadlock, journaled as fact). FIXING THE TOOL DID NOT RETRACT THE CONCLUSION I HAD ALREADY BANKED FROM IT -- I carried the poisoned finding forward into a new argument and it survived because it explained what I was seeing. A CORRECTED INSTRUMENT DOES NOT RE-EXAMINE THE CLAIMS IT ALREADY CORRUPTED; ONLY A DELIBERATE RE-DERIVATION DOES. When an instrument is found faulty, list every conclusion drawn from it and re-run them before building anything on top. 2026-09-03 land 2026-09-03 SUPERVISOR GUARD FIX DEPLOYED AND VERIFIED BY ARTIFACT, NOT BY RECEIPT. Added the missing generic gdeploy@ row to deploy_targets.conf health-probing its own 18095, then /api/deploy returned PROMOTED with the watchdog armed. Verified independently of deploy_status: serving-root binary 77504 to 77544 bytes; the running supervisor is pid 14899 with PARENT 6558 which is nx_hostctl hc_guard_dsup, so the parent guard respawned it from the new inode exactly as the LIFE-RECYCLE design states; /status returns cycle=2 against the old instance's 1186, which is what proves a NEW process is answering rather than the outgoing one; integrity=signed; and 45 rows read SERVING. The fleet was untouched -- nx_math_serve is still its original pid 7187 at etimes 6234, reparented to init and re-adopted BY NAME, and https://nishifamily.com/math still answers HTTP 200 in 30 ms. The fails[-1] read is now guarded in the live binary. 2026-09-03 land CONVERGENCE DONE, correcting my own queue row above. ioa_dmcache now exists at its DECLARED home in nx_ioadmit_lib rather than only in the standalone nx_cachewatch. Landed as an anchored APPEND: 34323 plus 9340 equals 43663 bytes, the predicted arithmetic exactly. Verified standalone first via nx_ioadm_probe against the same fixtures as nx_cachewatch_gate, and it AGREES with the standalone on all three: live-host tree returns 1 with caching=0 and degraded=1, healthy returns 0 with caching=1 and degraded=0, absent returns 3 with every slot at -1. 2026-09-03 lesson THE LAPTOP COPY OF nx_ioadmit_lib IS AN 11303 BYTE FOSSIL AGAINST 43663 ON THE NAS, missing all of OB0 and OB1 which landed today. Editing the fossil and pushing it would have DELETED another seat's work while looking like a normal promote -- a laptop build of a NAS-ahead source is the AHEAD class wearing a fresh timestamp. The safe shape was to verify the hunk standalone and push it as an APPEND, never to touch the local file. Any seat converging these trees must diff first and adopt per file, never wholesale. 2026-09-03 queue STILL OWED and blocked on the same physical fault. Neither ioa_dmcache nor nx_cachewatch has been BUILT on the NAS: build admission refused every attempt at load 13 to 25 because the write cache is off. Owed once nvme0n1 is replaced and md3 rebuilt: build the lib, run nx_cachewatch_gate on the NAS through /api/gate_run, then admit a gateroster row with that evidence. No roster row was added on laptop-only evidence, because the roster header requires NAS evidence for a hand-added gate.

OB10 Which telemetry nothing reads · cell PRESENT · gate NO-GATE-DECLARED

Contract	`us_classify` · executor Organ · Uncalibrated u · stands on nothing
Definition of done	A census of knowledge/status/ artifacts by how many DISTINCT sources name each one, so a sensor shipped with no reader is caught on the day it ships instead of being rediscovered a fifth time. LANDED 2026-09-03, gate 9 of 9, four bite-proven teeth, ratchet self-baselining.
Matrix cell	LOOP-INTEGRITY: which of our own telemetry outputs does NOTHING read · `runtime/nx_unread_sensor_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unread_sensor_lib`; declare `nx_unread_sensor_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

receipt_durability Capacity-aware durable evidence lifecycle · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`rg_receipt` · executor Workflow · Uncalibrated u · stands on OB1
Definition of done	DEFINED 2026-09-12 from observed Compare failure. Job1789237922 skipped3 receipts at1048588B against hardcoded1048576B, while measured available storage was20973773664256B (job1789238079); no physical exhaustion. Replace total-file cap and whole-history reads with bounded working memory, checked durable writes, capacity/quota/reserve observations and explicit failure states. Archive must preserve concurrent writes and immutable history; snapshot then truncate is not safe without writer coordination. Critical release evidence may not disappear behind GREEN. Private fixes underway; no deployment claimed. Research contract: knowledge/gates/estate-defect-prevention-research-20260912.json. Reuse existing publisher, archive, resource and config owners.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `rg_receipt`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-12 investigate 2026-09-12 observed archive source ignores fsync status, names archives only by epoch with truncating write, and resets live file after copying without shared writer coordination. No live reset authorized by this finding; private correction and negative tests requested. Preserve history. First-byte prevention includes language checked-effect handling and result propagation, API error contracts, capacity telemetry, and actual release receipts. This entry defines work, not SOTA completion. 2026-09-12 reconcile 2026-09-12 identity repair: earliest OB10 remains telemetry-reader census; its missing executor/estimate/dependency fields are Organ/Uncalibrated/- without inventing cost or dependency. The later capacity-aware evidence lifecycle reused OB10 accidentally; it now uses receipt_durability. Its Sep12 investigation log and OB11 prerequisite follow that same semantic owner. Exact prior plan retained at knowledge/gates/observability-pre-graph-reconcile-20260912.plan.txt; historical wording preserved. Rank must be regenerated by nx_compare_rank artifact-only, not hand-edited.

OB11 Incident-to-variant prevention across Nishi source and compiler · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nx_capsearch` · executor Workflow · Uncalibrated u · stands on receipt_durability
Definition of done	DEFINED 2026-09-12. Convert confirmed failures into invariant + minimized counterexample + source-owner links, then AST/control/data-flow variant queries with scanned/unsupported denominators. Classify protocol bounds, allocation safety bounds, user policy and arbitrary ceilings distinctly; do not delete useful safeguards. Prioritize ignored mandatory results, non-durable success, unchecked write/allocation arithmetic, unsafe concurrent lifecycle and compiler shadowing. Fuzz and fault-inject isolated candidates, model state transitions, prove old defects fail gates, then adopt shared fixes across consumers. Evolutionary search is a candidate generator only after independently protected evaluators and held-out workloads. Track precision, recurrence, escaped severity, mutation sensitivity and accepted outcomes per total supervision cost. Research methods/caveats retained in knowledge/gates/estate-defect-prevention-research-20260912.json.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nx_capsearch`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-12 measure 2026-09-12 native discovery: nx_capcliff remedy knowledge/status/comparepub.jrnl job1789238271 returns NO-READER readers=0 conf=PRESENT exit0 because its configured roster omits Compare; rg_receipt reader is independently verified in nx_compare_regen.nx. This is inventory incompleteness, not absence. Existing nx_srclint owner is textual and can update baseline on ordinary scan; read-only mode must be explicit. Reuse nx_failclass/nx_debtmine/nx_debt_recurrence for defect lineage and nx_parse/nx_ir semantic substrate for future analysis, not another scanner. Source+runtime+API inventory closure and unsupported denominators are prerequisites to autonomous domain gap decisions. 2026-09-12 land 2026-09-12 narrow coverage correction adopted into existing nx_capcliff MCP/API owner after full source and negative-test review. Selftest25/25 and existing adoption gate8/8 pass; actual registered remedy knowledge/status/comparepub.jrnl now UNREGISTERED exit3 (job1789238986), replacing NO-READER exit0. Output scopes evidence to declared roster and semantic coverage UNMEASURED; zero declared readers no longer proves absence. Canonical source SHA784c596bf38960c695b13589cf3c35e742c76ec72033fa4cccffc7d374c30eb4; live74720B SHA098e9f62c9e3dcb6f91846e11358bf58202f84e802857980ffe031c44f9301a9. Prior artifact retained and hashverified. This is a deployed diagnostic correction, not complete estate-wide semantic coverage or the journal writer fix; public Compare regeneration pending durable publisher qualification.

efp_progression Estate evidence progression observations · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`efp_progression` · executor Organ · Uncalibrated u · stands on nothing
Definition of done	LANDED 2026-09-12: existing nx_evidence_fleet measures explicit matrix-directory coverage, gate declarations, retained verdict structure and record age. Canonical run 1789245486 measured 119 matrix files, including candidates and fixtures. Current artifact binding remains unknown for all 119; historical all-green records are not current acceptance. Full snapshot knowledge/gates/estate-evidence-progression-canonical-20260912.json. Source/build/running/served joins remain OPEN.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `efp_progression`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-12 land Existing fleet owner now separates gate declarations from retained execution; misleading EXECUTED-EVIDENCE-BACKED wording corrected. Canonical qualification 12/12 includes malformed and duplicate fields, overflow, missing records, a 90000-byte, 5000-row streaming fixture and existing-snapshot refusal. Promoted 78536-byte ELF 34908166bc61c5a9c4396475f79fd52e98c073ee0612b65d37accbe0fe57551b independently hash-verified; actual canonical measurement completed with fsync 0, close 0. Operator registration verified in serving allowlist and schema; no capability scope widened. Optional output creates a new exclusive snapshot, never replaces one. Read-capability discovery omission remains separate. Whole-estate freshness, current source/build/running/served binding and ownership/rework/ROI metrics remain open. 2026-09-12 release 2026-09-12 structured evidence presentation: existing shared renderer projects the retained collector snapshot into an accessible named table, with stacked measure/count/meaning rows on narrow screens. Canonical parser/projection gate24/24 and graph/rank gate10/10 passed; private actual desktop/mobile reviewed. Missing, malformed, duplicate-equivalent keys and wrong digests refuse rather than fabricate counts. Snapshot identity and age retain their historical scope; current artifact acceptance remains unknown for all119. Canonical consumer artifacts were promoted and actual buildroot fork hashes reconciled through nx_restage. Scoped served acceptance is a separate retained delivery observation. 2026-09-12 release Promoted reviewed checker 0a53e72c and publisher ba0a7517 with expected digest checks and retained predecessors. Canonical qualification:57/57 import checks and6/6 actual CLI cases. Live scoped MCP checker passed one selected edge; live management API publisher verified existing Beach1116550B and shared module377847B, then returned UNCHANGED writes=0. Existing discovery row updated without changing permissions. This release adds reusable publication enforcement; it does not improve Beach visuals or establish estate-wide freshness. 2026-09-12 release Beach movement reached stable Beta through existing native register-release, stage-sized and publish-guarded-edge operations. Served HTML1147239B SHA349e55ad736edabebbda30e201a38550d54a8b879fad511fc74724e86bd5953c; selected shared runtime389535B SHAff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd. Actual served browser reported WebGPU nvidia/blackwell, no page errors in bounded review; framing and performance controls exercised. This is a visible incremental release, not photoreal acceptance. Next delivery gap: compose the existing sequence into one accountable release workflow and prioritize whole-character presentation and ground contact.

dossiers=15 cells_joined=12 no_matrix_row=3 (sum 15) gates_recorded=0 gates_unrecorded=0 no_gate_declared=12 (sum 12 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 20 feature rows mapped of 20 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/observability.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 0–1000, distinctiveness 0–1000 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 604 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 0–1000 · distinctiveness 0–1000 · breadth 0–1000 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 4 (a fact of the data: two players that close are that close) · data spread 182 permil of the plot

Nishi New Relic Datadog Prometheus+Grafana OpenTelemetry
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 21 (a fact of the data: two players that close are that close) · data spread 510 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	803	734	750	937	0 since 2026-09-23	16	10	2026-09-15
New Relic	Mainstream	839	208	383	638	0 since 2026-09-23	12	10	2026-09-15
Datadog	Mainstream	875	211	400	615	0 since 2026-09-23	13	10	2026-09-15
Prometheus+Grafana	Mainstream	821	180	350	583	0 since 2026-09-23	12	10	2026-09-15
OpenTelemetry	Peripheral	232	166	116	777	0 since 2026-09-23	3	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	20	5
2026-09-16	20	5
2026-09-17	20	5
2026-09-18	20	5
2026-09-19	20	5
2026-09-20	20	5
2026-09-21	20	5
2026-09-22	20	5
2026-09-23	20	5
2026-10-08	20	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 80, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	New Relic	Datadog	Prometheus+Grafana	OpenTelemetry
STORAGE
array redundancy as a HEALTH axis, not a separate dashboard Source present; authored stronger claim: `mdstat_degraded` in `runtime/_hdl_build/nx_healthtruth.nx`, verified at emit. LANDED 2026-09-03, and it closes a 33-DAY BLIND SPOT measured that day. nx_health returned overall OK degraded 0 down 0 reasons empty while md3 had run [2/1] [_U] since Aug 1 -- one leg of the RAID1 that is the SSD device of a WRITE_BACK cache holding 43,493,286 dirty blocks for the only volume. nx_raidwatch had printed verdict RED the entire time and nothing read it; the surface everyone DOES read had no storage axis at all. Worse, nx_healthtruth -- the organ built after a sev-9 incident to catch exactly this shape one axis over, for swap -- had been STAGED SINCE Aug 1 13:33 AND NEVER PROMOTED, so the detector for the blind spot was itself invisible for the same 33 days. Now live and registered: reads proc mdstat DIRECTLY rather than asking nx_raidwatch, because an auditor that borrows its subject's instrument stops being a second opinion; a degraded array is RED with no warn band, since either every member is present or the next failure is data loss; and it ABSTAINS on an unreadable mdstat so a host with no md is never convicted. THE EXCEED IS THE INDEPENDENCE: New Relic, Datadog and Netdata all surface disk metrics on a dashboard, and none of them makes a degraded array raise the SAME verdict the service-health rollup publishes, which is the only reason a month passed here. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-UNAUTHORISED` — PARTIAL: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetryCons not adopted yet: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	◐	◐	◐	○
RESOURCE
host axis that ABSTAINS instead of acquitting when blind Source present; authored stronger claim: `rm_verdict_blind` in `runtime/_hdl_build/nx_resmon_lib.nx`, verified at emit. A stale or absent reading degrades the axis to UNOBSERVABLE, which can neither raise nor lower the verdict. The field alerts on no-data as a monitor state, but the VERDICT still resolves without the missing axis, so an absent signal reads as a passing one. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=31 nonval=23` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	◐	◐	○
the blind axis raises an alarm ABOUT ITS OWN BLINDNESS Source present; authored stronger claim: `rm_blind_sev` in `runtime/_hdl_build/nx_resmon_lib.nx`, verified at emit. EXCEED. Abstention is safe for the verdict and INVISIBLE to the operator, so a detector that goes dark produces no alarm anywhere by design. Graded blindness severity closes that. Measured cost of not having it elsewhere in the estate: a leak axis dark for 5.7 hours while the pressure axis went amber. Adoption: `LIB-WIRED importers=31 nonval=23` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
leak by SUSTAINED growth across windows, not by a level Source present; authored stronger claim: `rm_sustained_count` in `runtime/_hdl_build/nx_resmon_lib.nx`, verified at emit. A level cannot express a leak. Requiring growth in EVERY window of N kills the false positives a high-water-mark predicate generates, and the horizon is published beside the verdict so nobody reads no-fast-leak as no-leak. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=31 nonval=23` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	◐	◐	○
CHURN
fork, context-switch and interrupt rates with a kernel-to-user ratio Source present; authored stronger claim: `pc_verdict` in `runtime/_hdl_build/nx_procchurn_lib.nx`, verified at emit. Built after the NAS measured 78.3 forks per second sustained with the kernel doing 2.36x the work of userspace. The field graphs process counts, it does not grade the kernel-to-user ratio as a first-class verdict. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	◐	◐	○
ADMIT
one I O-storm ruler shared by every spawner Source present; authored stronger claim: `ioa_spawn_budget` in `runtime/nx_ioadmit_lib.nx`, verified at emit. EXCEED. The same witness the build gate uses, so a spawner and the gate can never disagree about whether the box is in a storm. The field observes; it does not hand the observation back as an admission decision. Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
CONGESTION
writeback backlog as a LEVEL you can steer on Source present; authored stronger claim: `ioa_congestion` in `runtime/nx_ioadmit_lib.nx`, verified at emit. LANDED 2026-09-03 and deliberately UNARMED. procs_blocked is one of the noisiest fields in proc, measured at 6 then 0 twenty seconds apart on the same box, so a single sample decides admission by coin flip. Dirty plus Writeback is the slow-moving integral of the congestion that actually returns a 503. Bars ship at zero until a healthy distribution exists. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	◐	◐	○
ATTRIBUTION
WHO is blocked right now, by process root not by tree Source present; authored stronger claim: `ioa_count_comm_roots` in `runtime/nx_ioadmit_lib.nx`, verified at emit. A name inherited across fork counts a tree, not a population -- measured once as 63 live workers against a real 2. Cutting at the parent edge is the difference between a budget that works and one that reads zero forever. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	◐	○	○
HYGIENE
shared child reaper so a fork-per-request server cannot leak Source present; authored stronger claim: `dr_drain` in `runtime/nx_daemon_reap_lib.nx`, verified at emit. EXCEED. Gate 9 of 9 GREEN against real forked children with a fixture-reached tooth. Sixteen estate daemons were measured leaking zombies while exactly one sibling reaped correctly. The field reports zombie COUNTS as a metric and ships no remedy. Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetryCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	◉	○	○	○	○
READ
bounded tail reader for verdict logs Measured: `rm_trend_read_tail` exists in `runtime/_hdl_build/nx_resmon_lib.nx`, verified at emit. One shared tail reader rather than a per-consumer re-implementation. Ordinary in the field; recorded so the row is honest rather than flattering. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=31 nonval=23` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
DEVICE
block throughput and queue depth from diskstats Measured: `ioa_diskstats` exists in `runtime/nx_ioadmit_lib.nx`, verified at emit. OB1 LANDED 2026-09-03, the same day the gap was found. Diagnosing that storm required hand-reading proc diskstats over ssh, which named md4 at 14.2 MB per second written with 2157 I Os in flight -- the single most decisive number of the whole investigation, and no organ could read it. Now ioa_ds_parse is pure over a buffer so its tooth runs on fixture bytes rather than on whatever this host mounts, ioa_diskstats is the thin reader that owns the file and the cap, and ioa_sector_rate_kbs takes a DELTA so a cumulative counter can never be published as a throughput by accident. Gate 25 of 25 GREEN with the device match proven EXACT against a fixture where md40 precedes md4, an absent device proven UNREADABLE rather than zero, and a wrapped counter proven to abstain. EXCEED STAYS 0 AND THAT IS HONEST: Netdata and the Prometheus node exporter have read diskstats for years and are Best here. This is parity on collection, reached from nothing, not a lead. MEASURED LIMIT, RECORDED THE DAY IT LANDED: this axis stops at md and sata, so it CANNOT SEE A WRITE-BACK CACHE SITTING BETWEEN THE FILESYSTEM AND THE ARRAY. On 2026-09-03 that blind spot was the difference between knowing the array was slow and knowing why -- see OB9. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind New Relic (leads), Datadog (leads), Prometheus+Grafana (leads)	●	◉	◉	◉	●
CACHE
the device-mapper layer between the filesystem and the array Source present; authored stronger claim: `ioa_dmcache` in `runtime/nx_ioadmit_lib.nx`, verified at emit. OB9 and the rung this board exists to have found. MEASURED 2026-09-03 by hand: /volume1 is cachedev_0, a flashcache-syno device in mode WRITE_BACK whose ssd dev is alloc_cache_1 in shared_cache_vg1, whose sole PV is md3, which has been raid1 [2/1] [_U] since Aug 1 because /dev/nvme0n1 no longer exists. An UNMIRRORED WRITE-BACK CACHE holding 43,493,286 dirty write hits is a LOSS-OF-COMMITTED-WRITES exposure on the estate's only volume, and it ran unnoticed for 33 days. It also explains the storm: cache percent 95, write hit percent 2, replacement 11,685,150, and 40 dirty metadata writes per clean one, on half the NVMe bandwidth the cache was built with. NOT ONE ORGAN IN THE ESTATE READS THIS LAYER -- nx_raidwatch reports md degraded state and stops, so nothing could connect an array is degraded to therefore every write is slow AND committed data is at risk. THE EXCEED IS REAL AND SPECIFIC: New Relic, Datadog and the Prometheus node exporter all read diskstats and none of them tells you your write-back cache is unmirrored; Prometheus scores Part only because a textfile collector you write yourself could, which is not a shipped capability. The axis owed is cache mode, hit and dirty rates, and the REDUNDANCY STATE OF THE CACHE DEVICE ITSELF, joined so the verdict is one sentence a human can act on. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	◐	○
NETWORK
connection-churn axis, TIME_WAIT and accept rate DARK — `runtime/nx_ioadmit_lib.nx` EXISTS but does not declare `ioa_connchurn`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OB2. 202 TIME_WAIT against 29 ESTABLISHED, 21 of them to one localhost port, was the tell that named the storm source. Found by hand with netstat; no organ sees it. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ioa_connchurn Pros none measured yetCons behind New Relic (leads), Datadog (leads), Prometheus+Grafana (leads), OpenTelemetry; open contract; expected source declaration not established	○	◉	◉	◉	●
ATTRIBUTION
what share of host load is NOT OURS Source present; authored stronger claim: `ioa_ownership_census` in `runtime/nx_ioadmit_lib.nx`, verified at emit. OB3 LANDED 2026-09-03, gate 36 of 36 with five bite-proven teeth. It attributes BOTH the population AND the BLOCKED ROSTER, and the roster is the point: admission decides on procs_blocked, so attributing only the population answers a question nobody asks. ITS FIRST LIVE READING CORRECTED A CLAIM MADE HOURS EARLIER IN THE SAME SESSION: procs=792 ours=107 foreign=685 foreign_permil=864, yet blocked=5 with blocked_ours=4 and blocked_foreign=1 -- the population is 86 percent FOREIGN while the blocked roster is 80 percent OURS. Population, fork rate and blocked roster are THREE DIFFERENT SUBJECTS that give three different answers, and a session that slides between them will publish whichever flatters its story. The share function ABSTAINS on an uncountable population rather than rendering 0 permil, because telling a governor nothing is foreign at the moment it could not look is the most flattering possible lie about whose load it is. THE EXCEED IS REAL AND SPECIFIC: New Relic, Datadog and the Prometheus node exporter all attribute load to the services THEY instrument and are silent about the neighbours actually eating the machine -- none of them can answer what share of this box is not mine, which is the only question that makes a shared-host admission ring fair. Measured 2026-09-03: the dominant fork sources were synoscgi at 37, postgres at 18, nginx at 9 against nx_tools_api at 10 and the torrent lane at 6 -- the whole Nishi estate a MINORITY -- while DSM runs its churn at nice minus 10, above every Nishi lane. Our admission ring derives width from live load, so foreign churn shrinks OUR width and nothing shrinks theirs. The field attributes to services it instruments and is silent about the neighbours that are actually eating the box. Adoption: `LIB-WIRED importers=30 nonval=29` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
fork sources by PARENT, not by survivor sampling Source present; authored stronger claim: `pc_fork_by_parent` in `runtime/_hdl_build/nx_procchurn_lib.nx`, verified at emit. OB4 LANDED 2026-09-03, gate 42 of 42 with twenty bite-proven teeth. IT PUBLISHES A LOWER BOUND AND SAYS SO IN THE FIELD NAME. A pid diff attributed 2.2 forks per second where the kernel counter said 14.5, because A PID DIFF MEASURES SURVIVORS AND THE SHORT-LIVED MAJORITY IS THE CHURN. These are not two estimates of one quantity, they are two quantities, so the attributed census is printed as forkattrib=LOWER-BOUND beside kernel_forks with an explicit coverage_permil saying how much of the real fork count it could account for. Every partition sums and the gate asserts it on the LIVE host: attributed plus vanished_before_read equals new_survivors, and the two are separate counters because we-saw-it-and-could-not-read-it and there-was-nothing-to-read have opposite remedies. THE COST WAS BUDGETED BEFORE THE CODE WAS WRITTEN, WHICH CHANGED THE DESIGN: enumeration is getdents on /proc (a handful of syscalls at any process count) and only NEW pids get a stat read, so a beat costs about 50 syscalls rather than the 2300 a per-process walk would, which is why this runs unconditionally instead of hiding behind a severity switch. An instrument must not become the load it measures, and the way to honour that is to size the work first, not to add a flag afterwards. IT ADDS NO SECOND PARSER: the estate has exactly one /proc/<pid>/stat parser, ioa_stat_parse, which spans comm from the first paren to the LAST one because a comm may itself contain spaces and parentheses, and pc_ppid_of is a named accessor for its ppid slot. A first draft of that function read /proc/<pid>/status and parsed PPid: itself; it would have worked, and it was still the duplicate-ruler defect, caught only by reading the incumbent lib before building. THE EXCEED: New Relic, Datadog and the Prometheus node exporter report a process count and a fork rate; none of them attributes the fork counter to parents, and none of them tells you what fraction of the churn its own sampling could not see. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	◐	◐	○	○
LOOP
a severity that is actually READ by an actuator Measured: `pc_sev_consumer` exists in `runtime/_hdl_build/nx_procchurn_lib.nx`, verified at emit. OB5 LANDED 2026-09-03, gate 29 of 29 with fourteen bite-proven teeth (seven of them new). THE SENSOR HAD BEEN CORRECT AND UNREAD FOR 35 DAYS: procchurn.jrnl carried sev= on every frame since 2026-07-30 and nothing had ever consumed that field, so a correct RED sat on disk while the storm it described kept recurring. That is not a missing threshold, it is a missing READER, and the two are indistinguishable from any dashboard. THE CONSUMER READS THE FIELD BACK OFF DISK RATHER THAN OUT OF THE PRODUCER LIVE VARIABLE, on purpose: reading the in-memory value proves the arithmetic and proves nothing about the WIRE, and the wire is exactly where a producer and a consumer that are each correct in isolation still disagree. Proven live on first run, not merely in fixture: act=DEFER read=FRAME disk_sev=2 age_s=0 max_age_s=6 bar=DERIVED-from-window, with a truncate-written receipt at knowledge/status/procchurn.act. FOUR SEPARATE WAYS TO BE BLIND ALL RETURN UNOBSERVABLE AND NEVER PROCEED -- stale, unparseable, clock-skewed, and UNARMED -- because an unarmed guard that returns PROCEED is byte-for-byte indistinguishable from no guard at all and it fails in the flattering direction, so nobody investigates. The staleness bar is DERIVED from the measurement window rather than picked (two windows leaves a full window of margin, so only a frame this run did not write can blow it) and its provenance is printed on every line. The receipt is TRUNCATE-written, never appended: a check that greps an append-only journal is vacuously green forever, because a marker that ever appeared still matches. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=7 nonval=5` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of OpenTelemetry; fully adopted on the estate ladderCons behind New Relic (leads), Datadog (leads), Prometheus+Grafana (leads)	●	◉	◉	◉	○
ALERT
two-window burn-rate with a bounded action rate DARK — `runtime/nx_ioadmit_lib.nx` EXISTS but does not declare `slo_burn_rate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OB6. The field's short-plus-long window exists so an automated action does not latch after recovery. Also needs a minimum-denominator, because an alert that fires on zero requests is the gate-passes-on-the-empty-set defect wearing a deploy costume. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching slo_burn_rate Pros none measured yetCons behind New Relic (leads), Datadog (leads), Prometheus+Grafana; open contract; expected source declaration not established	○	◉	◉	●	○
HONESTY
an instrument that reports its OWN share of the measurement DARK — `runtime/nx_ioadmit_lib.nx` EXISTS but does not declare `ioa_observer_cost`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OB7. EXCEED and it has no counterpart anywhere in the field. Measured 2026-09-03: a sampling loop written to count forks was 180 of the 272 forks it recorded -- 66 percent observer. An instrument that cannot subtract itself publishes a number about itself. dossierwatching ioa_observer_cost Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
TRACE
spans with context propagation across a fork or exec boundary DARK — `runtime/nx_ioadmit_lib.nx` EXISTS but does not declare `tr_span_ctx`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OB8. The field's strongest suit and our weakest. Named honestly rather than scored generously. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching tr_span_ctx Pros none measured yetCons behind New Relic (leads), Datadog (leads), Prometheus+Grafana, OpenTelemetry (leads); open contract; expected source declaration not established	○	◉	◉	●	◉
LOOP-INTEGRITY: which of our own telemetry outputs does NOTHING read Source present; authored stronger claim: `us_classify` in `runtime/nx_unread_sensor_lib.nx`, verified at emit. OB10 LANDED 2026-09-03, gate 9 of 9 with four bite-proven teeth, PROMOTED and REGISTERED. IT EXISTS BECAUSE THIS ESTATE REDISCOVERED ONE SHAPE FOUR TIMES IN A SINGLE DAY: procchurn wrote a correct severity on every frame for 35 days and nothing read it; nx_raidwatch was verdict=RED throughout and nothing consumed it; loadgov LV1 was the same shape a board over; and nx_health reported OK for 16 services while having no storage axis at all, with the organ built for exactly that gap staged and never promoted. FOUR INDEPENDENT REDISCOVERIES IS NOT FOUR MISTAKES, IT IS A STRUCTURAL PATTERN WITH A MEASURED RECURRENCE RATE, and the estate owned no instrument that could have found the fifth. This one counts, for every artifact under knowledge/status/, how many DISTINCT sources name it literally, and reports NO-LITERAL-REFERENCE, SINGLE-NAMER, NAMED-BY-SEVERAL or STORE-FAMILY. A SENSOR WHOSE OUTPUT NOTHING READS CANNOT CHANGE AN OUTCOME, AND FROM ANY DASHBOARD IT IS INDISTINGUISHABLE FROM ONE THAT IS WORKING. TWO FALSE-POSITIVE CLASSES WERE FOUND BY HAND-ADJUDICATING ITS OWN FIRST HITS, NOT BY READING ITS COUNT, AND NEITHER WAS FIXED BY SUPPRESSION: run one put 238 of 257 rows in one known-uninteresting shape (seg-store shards, opened from a prefix computed at runtime, so a literal reference is impossible BY CONSTRUCTION) and run two went RED on the organ own ratchet baseline, which it writes into the directory it censuses. Each became its own NAMED bucket, because a detector that suppresses its false positives instead of classifying them has thrown away its own taxonomy. IT REFUSES TO RUN ON A SATURATED BOX and says UNPROVEN rather than reporting a comfortable zero, which is what it did on its first NAS invocation. Its counts are declared FLOORS: only .nx sources are scanned and a path assembled at runtime is invisible, so a SINGLE-NAMER row is a QUESTION rather than a verdict. THE EXCEED: New Relic, Datadog, Prometheus and Grafana all tell you what your telemetry SAYS; none of them tells you which of your own telemetry outputs nothing is listening to, which is the failure mode that let a correct RED sit unread on disk for 35 days. Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of New Relic, Datadog, Prometheus+Grafana, OpenTelemetry; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	14	rows carrying a Yes, Best or Part in a rival column
cited	0	a reference mark resolves to a pinned mirror
uncited	14	an observation read, badged until a reference lands
rows, summed	14	RECONCILED: the parts sum to the total 14

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-03	OB0	land	Writeback-congestion axis ioa_congestion landed in nx_ioadmit_lib: Dirty plus Writeback read from proc meminfo with the keys carrying their COLONS, because WritebackTmp: would otherwise answer for Writeback: and the wrong number would be confident rather than absent. Ships INERT (bars at 0 in knowledge/ioadmit.conf, UNCALIBRATED) so it can report and cannot yet refuse.
2026-09-03	OB0b	land	Shared child reaper nx_daemon_reap_lib landed (dr_reap_nonblocking, dr_reap_one, dr_drain, dr_throttle) after nx_capsearch over 7264 organs with corpus_complete=1 proved no such primitive existed. Gate 12 of 12 GREEN, whole-gate mutation bite killed=1. The WNOHANG discriminator forks a real live child and asserts the drain does not block on it, then that the same child is still collected once it exits.
2026-09-03	OB1	land	Block-device axis landed: ioa_ds_parse is PURE over a buffer so its teeth run on fixture bytes, ioa_diskstats is a thin reader owning the file and the cap, and ioa_sector_rate_kbs TAKES A DELTA. That signature is the guard: a cumulative counter cannot be handed to it and published as throughput. Device matching is exact -- the fixture puts md40 BEFORE md4 so a prefix matcher fails.
2026-09-03	OB3	land	Ownership attribution landed: ioa_ownership_census partitions BOTH the process population AND the blocked roster into ours and foreign, and ioa_share_permil ABSTAINS on an uncountable population rather than rendering 0 permil. Gate 36 of 36 with five bite-proven teeth. Promoted be5ac814, live and re-run GREEN.
2026-09-03	OB3	retract	A claim this session published hours earlier -- that the box is dominated by foreign load -- was CORRECTED BY THE INSTRUMENT BUILT TO TEST IT. First live reading: procs=792 ours=107 foreign=685 foreign_permil=864, and yet blocked=5 with blocked_ours=4. Second reading minutes later: blocked=9 blocked_ours=9 blocked_foreign=0. The POPULATION is 85 to 86 percent foreign while the BLOCKED ROSTER, which is the only thing ba_verdict actually reads, is 80 to 100 percent OURS. Population, fork rate and blocked roster are three different subjects that give three different answers, and a session that slides between them will publish whichever flatters its story.
2026-09-03	OB5	measure	The severity had been correct and unread for 35 days. procchurn.jrnl has carried sev= on every frame since 2026-07-30 and no organ in the estate had ever read that field. The two live frames taken while building this both read sev=2 with blocked=7 and blocked=14 against an 8-core box, so a correct RED was on disk throughout the storm this session opened on.
2026-09-03	OB5	land	pc_sev_consumer landed with pc_sev_last, pc_find_in, pc_int_at, pc_isdig and pc_act_name. Gate 29 of 29, fourteen bite-proven teeth of which seven are new. Promoted: gate 43b648f1, organ 8d6893c3, both _offc twins refreshed. Proven live on the real wire and not only in fixture: act=DEFER read=FRAME disk_sev=2 age_s=0 max_age_s=6 bar=DERIVED-from-window, receipt truncate-written to knowledge/status/procchurn.act.
2026-09-03	OB5	lesson	A SENSOR WHOSE SEVERITY NO ACTUATOR CONSUMES CANNOT CHANGE AN OUTCOME, AND FROM ANY DASHBOARD IT IS INDISTINGUISHABLE FROM ONE THAT IS WORKING. The gap was not a missing threshold, it was a missing READER. Three shapes were carried into the fix: read the field OFF DISK not out of the producer live variable, because the wire is where two organs each correct in isolation still disagree; make every way of being blind return UNOBSERVABLE and never PROCEED, including UNARMED, because an unarmed guard that proceeds is byte-for-byte indistinguishable from no guard; and TRUNCATE-write the receipt, because a check that greps an append-only journal is vacuously green forever.
2026-09-03	OB5	lesson	The staleness bar is DERIVED from the measurement window rather than picked, and its provenance is printed on every line. Two windows leaves a full window of margin, so the only thing that can blow the bar is a frame this run did not write -- which is exactly the silently-failed-append condition the freshness check exists to catch. A number chosen to make the teeth pass would have tested nothing.
2026-09-03	OB5	queue	The WHOLE-GATE mutation bite is UNPROVEN, not passed: nx_gate_bite returned BUILD-REFUSED-BY-ADMISSION (exit=6), so nothing was compiled and no claim is made about it. The fourteen gv_bite teeth are proven both polarities by construction; the harness proof is owed and is one re-run away when load clears.
2026-09-03	OB4	queue	Next rung, and the incumbent question is already settled: do NOT hand-roll a proc stat parser. nx_dstate.ds_field_from_state already parses fields ANCHORED PAST THE COMM PARENS, which is the trap (a comm can contain spaces and parentheses), and nx_ctxtop_lib already walks proc per-process with its own admission check. The honest shape for OB4 is to extract that parser into a lib both callers share, and to publish attributed forks as a LOWER BOUND against the kernel counter -- a pid diff measures SURVIVORS, and the short-lived majority is the churn.
2026-09-03	OB9	retract	The rung text above states the cache held 43 million dirty blocks for 33 days. MEASURED 2026-09-03 and WITHDRAWN. dirty_write_hits is a LIFETIME COUNTER, not a level. cache_info reads dirty_blocks=0 and flashcache_progress reads status=uncacheable_flush_done with initial_num_of_dirty=0 and remaining_num_of_dirty=0. NO DATA WAS EVER AT RISK. A frozen counter and a pinned level are indistinguishable in one sample, and the alarming reading is the one that gets published. The seat that wrote this rung and the seat correcting it made the same error hours apart.
2026-09-03	OB9	measure	Two spaced samples of flashcache_stats on the live host: writes +18366 equals disk_writes +18366 equals uncached_writes +18366, and reads +12546 total against only +35 cache hits, with every SSD-side counter frozen. The cache is FLUSHED AND DISABLED, so 100 percent of I O goes direct to the RAID5 array. mdstat reads md3 active raid1 nvme1n1p1 at 2 of 1 with nvme0n1 ABSENT. That is the entire mechanism of the day-long build-refusal storm, and the remedy is PHYSICAL rather than a build defect.
2026-09-03	OB9	land	nx_cachewatch and nx_cachewatch_gate written and PROVEN ON THE LAPTOP ONLY. 8 of 8 GREEN with four distinct verdict states, bite-proven killed=1, source and deployed subject both restored byte-identical. Sources landed on the NAS at 13306 and 12037 bytes. NOT BUILT ON THE NAS. Build admission refused every attempt at load 13 to 25, which is the storm this rung exists to detect.
2026-09-03	OB9	lesson	mode is NOT the discriminator. cache_info keeps printing mode=WRITE_BACK after the cache has been flushed and disabled, because that field records how the device was CONFIGURED rather than whether it is caching now. The live signal is flashcache_progress status=uncacheable. Gate tooth T2 makes this decidable by requiring two fixtures with BYTE-IDENTICAL cache_info to return DIFFERENT verdicts, so an organ keyed on mode fails that tooth and passes every other one.
2026-09-03	OB9	queue	CONVERGENCE OWED, AND NAMED AS MY OWN MISS. This rung declares the symbol ioa_dmcache inside nx_ioadmit_lib, and I built a STANDALONE nx_cachewatch without reading the rung first. The capability is right and its home is wrong, which is the duplicate-ruler shape. Close the contract at its DECLARED home by composing the proven logic into ioa_dmcache, then keep nx_cachewatch as the CLI and gate around that symbol or retire it reversibly. DO NOT flip this rung on the standalone organ.
2026-09-03	OB9	queue	Also owed before this rung can be trusted in production. The gate is proven on the laptop only, and gateroster.conf requires NAS evidence through /api/gate_run for a hand-added row, so no roster row was added. Build both on the NAS, run the gate there, then admit the row with its evidence line.
2026-09-03	OB5	retract	A claim made earlier in this same session is withdrawn: I reported that the C6 conjunct2 gap needed a new `nx_sota_status why <domain>` verb and filed a design for it. THERE IS ALREADY A REGISTERED TOOL CALLED nx_sota_why, LIVE on the MCP surface -- source, built, promoted, registered, authorised and INVOKED -- and nx_capsearch would have named it. That is a retrieval failure, not a discovery. What the measurement then showed is worse than a duplicate: nx_sota_why is an ALIAS of nx_sota_status (identical 56,557 B source and 125,712 B binary; no file named nx_sota_why exists anywhere under nishihost, find exit 0 no results), so it inherits an argv-ignoring main. Called with a domain name it prints the whole estate aggregate and says nothing about that domain. A NAME THAT PROMISES A CAPABILITY ITS BINARY DOES NOT HAVE IS WORSE THAN THE MISSING CAPABILITY, because the registry entry reads as coverage and stops anyone looking.
2026-09-03	OB5	lesson	nx_catalog reported SOURCE yes 56557B / BUILT yes / PROMOTED yes 125712B for nx_sota_why while no such file exists under this root. It is a STAT-BASED catalogue following a registry alias, so it answered about the target and named the alias. A STAT THAT FOLLOWS AN ALIAS CANNOT TELL YOU WHETHER THE THING YOU ASKED ABOUT EXISTS -- only whether something it points at does.
2026-09-03	OB5	land	The fix chosen was NOT a why-verb. This board already walks all 110 domains and prints each one class into a bucket, then makes only the estate total durable -- which is exactly why C6 reports UNEVALUABLE for every domain: A VERDICT THAT IS PRINTED BUT NOT PERSISTED CANNOT BE AGREED WITH, DISPUTED, OR REGRESSED AGAINST. nx_sota_status now truncate-writes knowledge/status/sota_board.ledger, one row per domain carrying class plus the numbers the class was derived from, ending in a partition that SUMS and a reconciliation line that checks the ledger classes against the separately-computed printed buckets. One extra file write in a walk that was already happening answers all 110 domains at once, and no existing caller changes by a byte.
2026-09-03	OB9	measure	2026-09-03 THE DEAD SUPERVISOR /status IS NOT COSMETIC -- IT IS A BOOTSTRAP DEADLOCK THAT BLOCKS ITS OWN REPAIR. nx_daemon_supervisor is DECLARED a daemon, so /api/promote correctly refuses it by name (refusal=DECLARED-DAEMON) and routes it to the health-checked /api/deploy, whose contract is validate then promote then http-health then auto-rollback. The supervisor's health surface IS /status on 127.0.0.1:18095, and that endpoint refuses connections (debt 1788393501). The code that serves it is a forked child of the supervisor, so THE FIX FOR THE HEALTH CHECK SHIPS INSIDE THE BINARY THE HEALTH CHECK MUST VALIDATE. Firing /api/deploy today would promote, fail the probe, and auto-roll-back -- a kill and respawn of the process keeping 44 daemons alive, during a measured I/O storm, for zero net change. The guard fix is BUILT AND STAGED and safe to leave staged: nx_daemon_supervisor.sov.elf.new 77544 bytes sha ea45f035, src_path verified, src_stable=1, nx_contentdiff GREEN over 231 runs with lost_from_live=0.
2026-09-03	OB9	lesson	A DAEMON WHOSE ONLY HEALTH SURFACE IS SERVED BY ITSELF CANNOT BE SHIPPED BY A HEALTH-CHECKED LANE ONCE THAT SURFACE DIES -- the deploy gate and the defect are the same process, so the safety mechanism becomes the thing preventing the repair. This is the static-stability violation the estate already records for the control plane, arriving one layer down: the undo path traverses the subject. Two ways out and both are declarations rather than code: give the deploy row a health probe that does NOT live inside the subject (the parent guard nx_hostctl hc_guard_dsup is alive at pid 6558 and observes it from outside), or take an operator window for a deliberate restart. Choosing neither silently is how a staged safety fix becomes indistinguishable from abandoned junk.
2026-09-03	OB9	measure	2026-09-03 THE SUPERVISOR WAS HEALTHY THE WHOLE TIME AND ITS DEAD /status IS WHY THAT TOOK AN HOUR TO ESTABLISH. Measured directly: nx_math_serve.elf pid 7187 parent 631 etimes 3173, launched by the supervisor from its signed daemons.reg row and serving in 1.45 ms, while five successive hypotheses were built about why the supervisor would not launch it. With /status answering, ONE call would have listed the fleet and ended the investigation at the first minute. The cost of an unobservable supervisor is not measured in the incidents it hides but in the investigations it forces.
2026-09-03	OB9	retract	2026-09-03 THE BOOTSTRAP DEADLOCK I JOURNALED EARLIER TODAY IS FALSE AND IS WITHDRAWN. I wrote that nx_daemon_supervisor could not ship through the health-checked lane because its /status on 18095 was dead and the fix shipped inside the binary the health check must validate. /status WAS NEVER DEAD. Measured: netstat shows 127.0.0.1:18095 LISTEN held by the status child, that child sits in inet_csk_accept, and curl returns HTTP 200 with cycle=1186 integrity=signed. The discriminating experiment was a client with no argv grammar to get wrong. What actually blocked the deploy was mundane and fixable in one line: nx_daemon_supervisor had NO ROW IN deploy_targets.conf, so /api/deploy answered unknown target. Debt 1788393501's claim that /status serves an 83 byte empty body is stale on this evidence and should be re-derived before anyone acts on it.
2026-09-03	OB9	lesson	I PRODUCED THE SAME FALSE DEATH CERTIFICATE TWICE FROM THE SAME CAUSE, THE SECOND TIME AFTER I HAD ALREADY DIAGNOSED AND FIXED THAT CAUSE. nx_http_probe takes path then expect then port and has NO host argument; called host-first it probes port 0 and answers connect-failed. That produced a false /math is down (five wrong hypotheses against a service that had been serving 53 minutes) and then a false /status is dead (a fabricated architectural deadlock, journaled as fact). FIXING THE TOOL DID NOT RETRACT THE CONCLUSION I HAD ALREADY BANKED FROM IT -- I carried the poisoned finding forward into a new argument and it survived because it explained what I was seeing. A CORRECTED INSTRUMENT DOES NOT RE-EXAMINE THE CLAIMS IT ALREADY CORRUPTED; ONLY A DELIBERATE RE-DERIVATION DOES. When an instrument is found faulty, list every conclusion drawn from it and re-run them before building anything on top.
2026-09-03	OB9	land	2026-09-03 SUPERVISOR GUARD FIX DEPLOYED AND VERIFIED BY ARTIFACT, NOT BY RECEIPT. Added the missing generic gdeploy@ row to deploy_targets.conf health-probing its own 18095, then /api/deploy returned PROMOTED with the watchdog armed. Verified independently of deploy_status: serving-root binary 77504 to 77544 bytes; the running supervisor is pid 14899 with PARENT 6558 which is nx_hostctl hc_guard_dsup, so the parent guard respawned it from the new inode exactly as the LIFE-RECYCLE design states; /status returns cycle=2 against the old instance's 1186, which is what proves a NEW process is answering rather than the outgoing one; integrity=signed; and 45 rows read SERVING. The fleet was untouched -- nx_math_serve is still its original pid 7187 at etimes 6234, reparented to init and re-adopted BY NAME, and https://nishifamily.com/math still answers HTTP 200 in 30 ms. The fails[-1] read is now guarded in the live binary.
2026-09-03	OB9	land	CONVERGENCE DONE, correcting my own queue row above. ioa_dmcache now exists at its DECLARED home in nx_ioadmit_lib rather than only in the standalone nx_cachewatch. Landed as an anchored APPEND: 34323 plus 9340 equals 43663 bytes, the predicted arithmetic exactly. Verified standalone first via nx_ioadm_probe against the same fixtures as nx_cachewatch_gate, and it AGREES with the standalone on all three: live-host tree returns 1 with caching=0 and degraded=1, healthy returns 0 with caching=1 and degraded=0, absent returns 3 with every slot at -1.
2026-09-03	OB9	lesson	THE LAPTOP COPY OF nx_ioadmit_lib IS AN 11303 BYTE FOSSIL AGAINST 43663 ON THE NAS, missing all of OB0 and OB1 which landed today. Editing the fossil and pushing it would have DELETED another seat's work while looking like a normal promote -- a laptop build of a NAS-ahead source is the AHEAD class wearing a fresh timestamp. The safe shape was to verify the hunk standalone and push it as an APPEND, never to touch the local file. Any seat converging these trees must diff first and adopt per file, never wholesale.
2026-09-03	OB9	queue	STILL OWED and blocked on the same physical fault. Neither ioa_dmcache nor nx_cachewatch has been BUILT on the NAS: build admission refused every attempt at load 13 to 25 because the write cache is off. Owed once nvme0n1 is replaced and md3 rebuilt: build the lib, run nx_cachewatch_gate on the NAS through /api/gate_run, then admit a gateroster row with that evidence. No roster row was added on laptop-only evidence, because the roster header requires NAS evidence for a hand-added gate.
2026-09-03	OB4	land	pc_fork_by_parent landed with pc_pids, pc_pid_seen, pc_ppid_of, pc_tally_parent and pc_attrib_permil, wired into nx_procchurn on every beat. Gate 42 of 42 with twenty bite-proven teeth. Live first run: new_survivors=6 attributed=6 distinct_parents=3 vanished_before_read=0 kernel_forks=35 coverage_permil=171 pids_seen=769 cap_hit=0, naming three parent pids and what each spawned.
2026-09-03	OB4	measure	COVERAGE 171 PERMIL IS THE FINDING, NOT A DEFECT. In that window the kernel forked 35 processes and the survivor census could account for 6 of them. The other 29 lived and died inside 3 seconds. That is the whole argument of this rung expressed as a number on the live host, and it is why the attributed count is printed as forkattrib=LOWER-BOUND beside kernel_forks rather than as a rate.
2026-09-03	OB4	lesson	THE COST BUDGET CHANGED THE DESIGN, AND IT ONLY DID SO BECAUSE IT WAS COMPUTED BEFORE THE CODE. My first instinct was to hide the walk behind a severity check, reasoning that a per-process walk on a storming box is the diagnostic-becomes-the-load defect. Then I counted: enumeration is getdents on /proc, a handful of syscalls at ANY process count, and only NEW pids get a stat read -- about 50 syscalls per beat against the 2300 a full walk would cost. The switch was unnecessary and would have made the instrument blind exactly when it matters. BUDGET THE COMPLEXITY BEFORE WRITING, NOT AFTER, BECAUSE THE ANSWER CHANGES WHAT YOU BUILD.
2026-09-03	OB4	retract	A first draft of pc_ppid_of read /proc/<pid>/status and parsed PPid: itself. It would have worked. It was still the duplicate-ruler defect, written in the same session in which I recorded the law against it twice. The estate has exactly ONE /proc/<pid>/stat parser, ioa_stat_parse, which spans comm from the first paren to the LAST one because a comm may contain spaces and parentheses; the shipped pc_ppid_of is a named accessor for its ppid slot and adds no parsing. CHECK-BEFORE-BUILD APPLIES TO THE FUNCTION YOU ARE ABOUT TO WRITE, NOT ONLY TO THE ORGAN, and the check that caught it was reading the incumbent lib rather than trusting my own memory of it.
2026-09-03	OB4	lesson	The consolidation direction is fixed by the import graph and had to be recorded so nobody 'fixes' it the wrong way: nx_ctxtop_lib carries ct_find, which is pc_pid_seen under another name, but nx_ctxtop_lib IMPORTS nx_procchurn_lib, so the cycle is not resolvable upward. pc_pids is the landing place for that consolidation -- a pid enumerator with nothing else in it -- and ioa_ownership_census and ioa_count_comm_mode both bake enumeration into their classification so neither can lend it out today.
2026-09-03	OB5	land	C6 producer side landed and PROMOTED: nx_sota_status 131144 B sha 5ebf1da7 now truncate-writes knowledge/status/sota_board.ledger. Live reading reconciles GREEN -- proven=0 red=0 mech_ok=77 claim_only=27 unproven=6 sum=110 domains=110, matching the printed buckets exactly. observability itself reads class=MECH-OK cov=789 exceed=12 gaps=4.
2026-09-03	OB5	land	And the consumer the name had been promising for weeks: nx_sota_why is now a REAL organ (26515 B sha 9413f78a) with nx_sota_why_gate at 14 of 14 GREEN on the NAS, four teeth bite-proven. It answers WHERE ONE DOMAIN STANDS and WHAT THE ONE NEXT STEP IS, reading the ledger and re-deriving nothing. Five refusals each carry their own exit code: absent ledger, capped ledger, self-inconsistent ledger, stale ledger, unknown domain -- because a fact about the EVIDENCE and a fact about the ARGUMENT have opposite remedies and must never share an exit.
2026-09-03	OB5	lesson	ITS OWN GATE CAUGHT THREE OF MY DEFECTS BEFORE ANY OF THEM SHIPPED, AND THE MOST IMPORTANT ONE WAS IN A GUARD. The no-silent-cap check tested n >= SW_CAP, but rm_read reads at most cap-1 and NUL-terminates, so a fully truncated read returns exactly cap-1 and the guard COULD NEVER FIRE -- the no-silent-cap check was itself silent. It was caught only because the tooth is PAIRED: a fixture-reached tooth proving the fixture really exceeded the cap, beside an outcome tooth proving the organ noticed. A CAP GUARD MUST BE WRITTEN AGAINST THE READER ACTUAL FULL-CAP SIGNAL, NEVER AGAINST THE CAP YOU HANDED IT; the two differ by whatever that reader reserves and the difference is invisible. The other two were a hand-guessed row-end constant (34, really 33) and a fixture 5 KB short of the bar it was meant to exceed -- both caught by fixture-reached teeth, both of which would otherwise have read as bugs in the subject.
2026-09-03	OB5	queue	BUILT AND UNWIRED ON THE MCP SURFACE, NAMED RATHER THAN GLOSSED. /api/tools/register is idempotent BY NAME ONLY -- it returns ALREADY-REGISTERED and keeps the old elf -- and nx_toolreg_reconcile only registers MISSING rows, so the MCP name nx_sota_why still routes to nx_sota_status.elf. Direct exec of ./nx_sota_why.elf <domain> works today. Debt 1788477358 sev 6 carries the unblock condition (a re-point verb on the mgmt API). NOT attempted in-session on purpose: that deploy restarts the transport every concurrent seat calls through, there is an open bind race on it, the box is in a measured I O storm, and a sibling seat is live. A REDISCOVERY, NOT A NEW FINDING: an EATEN row from 2026-07 already recorded that /api/tools/register REFUSES update -- the row was closed and the defect was not, which is exactly how a defect gets independently rediscovered at cost.
2026-09-03	OB4	lesson	THE LAPTOP BUILD FARM IS THE ANSWER WHEN ADMISSION REFUSES EVERYTHING, AND IT WORKED END TO END TODAY. After ten paced refusals at procs_blocked 8 to 10 the nx_sota_why pair was built on the laptop under WSL with no governor, gate-run there, then shipped to the NAS and promoted with hashes verified byte-identical on both sides. The recorded precondition held and was checked, not assumed: the laptop closure was BEHIND the NAS on five files, so the NAS copies were adopted after a size and date diff rather than blindly, since a laptop build of a NAS-ahead source is the AHEAD class wearing a fresh timestamp.

Debt register

Id	Sev	What it is	Unblock
1788971717open	7	Comprehensive sovereign telemetry validated by Beach delivery and bug reproduction	Connect build-to-frame evidence through existing owners and ranker task1788971061; validate actual Intel/NVIDIA adapters and free-roam interactions, dropped samples, missing timestamps, device loss and telemetry outage. No complete or SOTA claim until coverage and overhead are measured.

Release history continued

When	Rung	Kind	Entry
2026-09-09	OB8	queue	2026-09-09 operator: comprehensive SOTA telemetry especially for sovereign development. Standards checked: OpenTelemetry overview and metrics data model, W3C Trace Context. Use interoperable semantics and export with estate-owned collection/storage/control. Current Beach gaps include uncounted draws, latest-only GPU sample, browser-inaccessible GPU memory and no complete request-to-frame trace. Actual adapter telemetry is qualified separately; end-to-end coverage remains open.
2026-09-09	OB8	queue	2026-09-09 operator also requires autonomous movement and visual-fault telemetry: correlate absolute/local entity coordinates, origin shifts, tick/input, ground contact and rendered attachment evidence with release identity. Detect uncommanded warps, resets, floating or penetrating bodies/props/plants and detached hair/clothes; expected transitions must be explicit and screenshots alone cannot establish physics correctness. Capture bounded replay windows and dropped-sample/observer-cost evidence. Current implementation and public board refresh remain unverified.
2026-09-09	OB8	queue	2026-09-09 operator explicitly requested a telemetry Compare board and targets exceeding the three physics-debugging references. Existing observability board is the owner; PT1-PT6 above define acceptance evidence, not implemented features or benchmark wins. Native and served-Wasm terrain-cache tests now detect a real Beach fault and validate its correction; full runtime anomaly collection and public history remain open.
2026-09-12	receipt_durability	investigate	2026-09-12 observed archive source ignores fsync status, names archives only by epoch with truncating write, and resets live file after copying without shared writer coordination. No live reset authorized by this finding; private correction and negative tests requested. Preserve history. First-byte prevention includes language checked-effect handling and result propagation, API error contracts, capacity telemetry, and actual release receipts. This entry defines work, not SOTA completion.
2026-09-12	OB11	measure	2026-09-12 native discovery: nx_capcliff remedy knowledge/status/comparepub.jrnl job1789238271 returns NO-READER readers=0 conf=PRESENT exit0 because its configured roster omits Compare; rg_receipt reader is independently verified in nx_compare_regen.nx. This is inventory incompleteness, not absence. Existing nx_srclint owner is textual and can update baseline on ordinary scan; read-only mode must be explicit. Reuse nx_failclass/nx_debtmine/nx_debt_recurrence for defect lineage and nx_parse/nx_ir semantic substrate for future analysis, not another scanner. Source+runtime+API inventory closure and unsupported denominators are prerequisites to autonomous domain gap decisions.
2026-09-12	OB11	land	2026-09-12 narrow coverage correction adopted into existing nx_capcliff MCP/API owner after full source and negative-test review. Selftest25/25 and existing adoption gate8/8 pass; actual registered remedy knowledge/status/comparepub.jrnl now UNREGISTERED exit3 (job1789238986), replacing NO-READER exit0. Output scopes evidence to declared roster and semantic coverage UNMEASURED; zero declared readers no longer proves absence. Canonical source SHA784c596bf38960c695b13589cf3c35e742c76ec72033fa4cccffc7d374c30eb4; live74720B SHA098e9f62c9e3dcb6f91846e11358bf58202f84e802857980ffe031c44f9301a9. Prior artifact retained and hashverified. This is a deployed diagnostic correction, not complete estate-wide semantic coverage or the journal writer fix; public Compare regeneration pending durable publisher qualification.
2026-09-12	efp_progression	land	Existing fleet owner now separates gate declarations from retained execution; misleading EXECUTED-EVIDENCE-BACKED wording corrected. Canonical qualification 12/12 includes malformed and duplicate fields, overflow, missing records, a 90000-byte, 5000-row streaming fixture and existing-snapshot refusal. Promoted 78536-byte ELF 34908166bc61c5a9c4396475f79fd52e98c073ee0612b65d37accbe0fe57551b independently hash-verified; actual canonical measurement completed with fsync 0, close 0. Operator registration verified in serving allowlist and schema; no capability scope widened. Optional output creates a new exclusive snapshot, never replaces one. Read-capability discovery omission remains separate. Whole-estate freshness, current source/build/running/served binding and ownership/rework/ROI metrics remain open.
2026-09-12	receipt_durability	reconcile	2026-09-12 identity repair: earliest OB10 remains telemetry-reader census; its missing executor/estimate/dependency fields are Organ/Uncalibrated/- without inventing cost or dependency. The later capacity-aware evidence lifecycle reused OB10 accidentally; it now uses receipt_durability. Its Sep12 investigation log and OB11 prerequisite follow that same semantic owner. Exact prior plan retained at knowledge/gates/observability-pre-graph-reconcile-20260912.plan.txt; historical wording preserved. Rank must be regenerated by nx_compare_rank artifact-only, not hand-edited.
2026-09-12	efp_progression	release	2026-09-12 structured evidence presentation: existing shared renderer projects the retained collector snapshot into an accessible named table, with stacked measure/count/meaning rows on narrow screens. Canonical parser/projection gate24/24 and graph/rank gate10/10 passed; private actual desktop/mobile reviewed. Missing, malformed, duplicate-equivalent keys and wrong digests refuse rather than fabricate counts. Snapshot identity and age retain their historical scope; current artifact acceptance remains unknown for all119. Canonical consumer artifacts were promoted and actual buildroot fork hashes reconciled through nx_restage. Scoped served acceptance is a separate retained delivery observation.
2026-09-12	efp_progression	release	Promoted reviewed checker 0a53e72c and publisher ba0a7517 with expected digest checks and retained predecessors. Canonical qualification:57/57 import checks and6/6 actual CLI cases. Live scoped MCP checker passed one selected edge; live management API publisher verified existing Beach1116550B and shared module377847B, then returned UNCHANGED writes=0. Existing discovery row updated without changing permissions. This release adds reusable publication enforcement; it does not improve Beach visuals or establish estate-wide freshness.
2026-09-12	efp_progression	release	Beach movement reached stable Beta through existing native register-release, stage-sized and publish-guarded-edge operations. Served HTML1147239B SHA349e55ad736edabebbda30e201a38550d54a8b879fad511fc74724e86bd5953c; selected shared runtime389535B SHAff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd. Actual served browser reported WebGPU nvidia/blackwell, no page errors in bounded review; framing and performance controls exercised. This is a visible incremental release, not photoreal acceptance. Next delivery gap: compose the existing sequence into one accountable release workflow and prioritize whole-character presentation and ground contact.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/observability.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain observability, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 20 capabilities: 16 exclusive to it and 4 shared with other boards. Shared rows on this page: 4 = home here 2 + home elsewhere 2 + ambiguous 0 + undecided 0 + refused 0 (partition 4); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=7125.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
ioa_spawn_budget	`nx_ioadmit_lib.nx`	loadgov*+, observability+, degradation	loadgov	rung	plan	home elsewhere adopt: `@xrow loadgov\|ioa_spawn_budget\|home by rung (fleet duplicate census)`
rm_trend_read_tail	`nx_resmon_lib.nx`	loadgov*+, observability	loadgov	rung	plan	home elsewhere adopt: `@xrow loadgov\|rm_trend_read_tail\|home by rung (fleet duplicate census)`
ioa_congestion	`nx_ioadmit_lib.nx`	observability*+, degradation	observability	rung	plan	home here
ioa_dmcache	`nx_ioadmit_lib.nx`	observability*+, degradation	observability	rung	plan	home here

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396230 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_ctxtop_lib`	observability	plan-queue	rung=OB4
directive	`nx_cachewatch`	observability	plan-queue	rung=OB9
directive	`nx_cachewatch_gate`	observability	plan-queue	rung=OB9

rows shown 3|this board's directives 3|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/observability.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls