Nishi Compare · capabilities, evidence and delivery

Traffic Safety

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

How traffic survives a change and how a bad change is undone -- the sovereign edge, routing and process replacement vs nginx and HAProxy and Envoy and Argo Rollouts. Rival codes are documented-capability reads of 2026-08-21, each grounded by a mirrored and content-pinned reference. Nishi cells are MEASURED -- the generator requires the implementing symbol in the real organ source on disk.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Measured 2026-08-21, full population with declared coverage. We hold the half of this domain nobody else has -- two capability-loss oracles that name every route a candidate binary would stop serving, built after that regression hit us five times -- and we are behind on every mechanism that keeps traffic alive while a change lands. Three numbers set the position. nx_http_server_listen_hot resolves 9 times estate-wide and exactly 2 are production call sites, so the sites.elf front door that all 69 live route rows cross cannot hand off at all. rt_sigaction resolved 8 times and every one was SIGPIPE handling or a crash handler or the signal library itself, so ZERO daemons drained on TERM -- and that is now ONE, nx_survey_daemon, shipped 2026-08-21. The census also pointed at a file that could never have carried the fix: nx_signal spells rt_sigaction as RV64 134, which is not a key in the x86 backend's translation table whose default branch is a pass-through, so on the live target it lands on uselib and installs nothing. The shipped drain installs no handler at all -- it BLOCKS TERM and consumes it as a pollable descriptor, which removes the EINTR mid-response truncation a handler would itself have introduced, and its deadline is DERIVED from ACCEPT_TMO_S rather than typed. sys_sendmsg WAS ABSENT-PROVEN at corpus_complete=1; that gap was closed on 2026-08-21 and TS1 has since MET its accept rule (ARMED zero drops over 17 connections with the in-gap arrival served, NEG-CONTROL 1 drop with the in-gap arrival refused ECONNREFUSED), so the remaining deficit on the continuity half was the ADOPTION of that mechanism by the serving daemons rather than its absence from the shim -- and that half opened and closed on the same day. nx_survey_daemon is the FIRST ADOPTER: chosen from the route table rather than from taste (one of 69 live rows, its own binary, no control-plane path, deliberately NOT sites.elf which is TS3), it calls ts_handoff_nodrop instead of binding and arms the TS2 drain before its listener exists. Proven in DROPPED CONNECTIONS across a real fork+exec restart of the real binary rather than by a source reference: nx_survey_handoff_gate 12/12, ADOPTED attempted=17 served=17 drops=0 with the in-gap arrival served, NEG-CONTROL the same binary with no owner attempted=17 served=16 drops=1 refused ECONNREFUSED. Envoy's ordering rule went in with it -- the arenas and the seg-store warm now run BEFORE the socket is acquired. What is left is a deploy decision and an owner process, and because the call falls back to binding when no owner publishes, the adopted daemon is safe to deploy before any owner exists. The undo path for a bad deploy runs through the front door whose restart is the incident, and an 8-minute estate-wide blackout is on record.

Where we need to go. A deploy that no client can observe, and an undo that is a process we did not kill rather than a build we have to run. Concretely: the listening socket is never released, the outgoing process keeps serving after TERM until a named deadline, a candidate is exercised on mirrored traffic before any user depends on it, promotion waits for a minimum number of real requests, and the rollback action is mechanically PROVEN not to traverse the thing it rolls back.

The unit. 1 u = one measured session-leg. Estate calibration: a greenfield engine with a bite-proven gate has measured 2 to 4 legs; a compose-existing-organs rung has landed in one leg repeatedly, including the storm ceiling and the D-state witness on 2026-08-17. Estimates are relative to those and recalibrate as rungs land.

Where we are: 7 open rungs. One exceed held on the oracle half. TS1, TS2 and TS3 all LANDED 2026-08-21 -- TS1 and TS2 ADOPTED into nx_survey_daemon and proven in dropped connections across a real restart, TS3 shipped as a standalone router deliberately NOT wired into sites.elf. The continuity half now holds its whole first milestone rather than nothing. Counts measured at emit below this line.

Cost to a deploy nobody sees: 0 u remaining of 4.5, and the honest caveat is WIRING not COST. TS1, TS2 and TS3 are all built and gate-proven (2026-08-21). TS1+TS2 are ADOPTED into a real serving daemon and proven in dropped connections across a real restart; TS3 is proven as a standalone router and is deliberately NOT wired into sites.elf, because the front door all 69 route rows cross is the one place a deploy-safety change has estate-wide blast radius. So the ENGINEERING for a deploy nobody sees is done and the REACH is one daemon: what is left is two operator decisions -- deploy the adopted daemon, and decide whether the estate's real front door adopts the slot pattern -- neither of which is a unit of build cost. The order held and was worth holding: the two shipped together into one daemon precisely because a drain with no overlap still drops the arrivals and an overlap with no drain still cuts the in-flight, and the adoption gate exercises both at once -- its reap sends TERM, so every restart it measures is also a drain.

Cost to a canary that serves nobody: 2 u. TS4 mirror to a shadow port and discard the response, which on one box needs no router and no second replica.

Cost to an undo we can trust: 4 u. TS5 bake with a denominator, TS6 rollback fired by the capability-loss oracle with all four safeties, TS7 the gate that refuses when the undo path traverses the subject.

Research bar. nginx is measured on both generations accept at once and rollback is a signal to a master that never stopped. Theirs: the continuity bar and the rollback bar. Ours: TS1 and TS7 are measured against this page.

Research bar. HAProxy is measured on the listening descriptor is transferred over SCM_RIGHTS rather than re-bound. Theirs: the only implementation that removed the race instead of shrinking it. Ours: TS1.

Research bar. Envoy is measured on all expensive initialization happens BEFORE the handoff while the old process still serves. Theirs: the ordering rule that is the direct fix for our blackout. Ours: TS1 and TS2.

Research bar. Argo Rollouts is measured on metric-gated promotion with a genuine third inconclusive state that pauses. Theirs: the progressive-delivery reference. Ours: TS5 and TS6.

Latest recorded release

2026-09-05 · TS11

nx_statuscensus source LANDED in buildroot/runtime: nx_statuscensus_lib.nx (16859 B, the ONE classifier -- edge sites_telemetry.log tail window into the partition DELIVERED / EMPTY / 404 / SYNTH-5xx / UNDEFINED (rc<0, no HTTP status) plus a separate proxied-unstatused axis for vh=70 rows whose backend status the edge never journals; actlog.jrnl into DELIVERED / EMPTY / ERROR / RECEIPT; SLA permil = delivered over ALL rows so an empty 200 is not a delivery; a window under min_rows is UNOBSERVED and never votes; level truncate-written to knowledge/status/statuscensus.status with verdict= as the LAST line, trajectory appended to knowledge/status/statuscensus.log), nx_statuscensus.nx (1687 B program, bars from knowledge/statuscensus.conf, defaults announced src=default), nx_statuscensus_gate.nx (10935 B: four in-process fixture runs RED / GREEN-with-absent-journal / UNOBSERVED / tail-window, three neg-controls, every number asserted and emitted via gv_check_eq). Builds QUEUED by admission under the I/O storm (BQ-nx_statuscensus_gate, BQ-nx_statuscensus). Next: gate GREEN on the NAS, promote + register + nx_offc_install, a clock row running the census, the first live status row, then the watch flips and the emitter renders it. Owed after that: a st=<code> field on nx_telemetry_emit so proxied replies stop reading as delivered-by-bytes.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

18 of 25 capability source symbols found|1 of them authored stronger-claims|7 open|coverage 720/1000|adoption 15 full / 3 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 19 vs present 19 · named + unnamed + withheld = 6 vs open 6 · both reconcile

liar-kill conj=gPQN · first failing conjunct: grounded

graded document: BUILDROOT tree, 44197 bytes · gates map: PRIMARY · stamped 0d 7h ago · source ../knowledge/status/evstamp_trafficsafety.verdict

Gap class	What it is, and the work it names
UNSUPPORTED-CLAIM	A row published as measured names a symbol that is NOT in the organ file it cites. This is the one class worse than an open gap, because it is a published claim carrying a source line beside it as apparent proof.
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence trafficsafety itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_INCONSISTENT. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Current prerequisite graph is invalid or unavailable. Historical rank data is retained, but cannot establish a current order. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Capability-loss oracle on promote (TS0)	rg_missing	Every route the live binary serves is extracted and each one the candidate does not carry is NAMED before promote -- LANDED, and the exceed this domain holds	Organ	0 u
Keep the socket replace the process (TS1)	ts_handoff_nodrop	An owner outside the serving process holds the listener and hands it to each generation, so the port never disappears and arrivals queue rather than being refused. ACCEPT RULE PRE-DECLARED, and it is the estate's own already-written bar: a swap under a synthetic request stream drops ZERO connections, measured by a client that counts refusals and resets, not by the daemon's own log. The neg-control is mandatory -- the same harness against the CURRENT ordinary-listener path must show a non-zero drop, or the test proves nothing. Blocked on sys_sendmsg for the SCM_RIGHTS form, so the socket-activation form ships first and the blocker is named in the row	Organ	2 u
Cooperative drain on TERM with a named deadline (TS2) after TS1	ts_drain_on_term	On TERM the daemon STOPS ACCEPTING and KEEPS SERVING in-flight requests until a declared deadline, then exits; the deadline is a named constant, never a literal. ACCEPT RULE: with a request in flight at the moment TERM lands, the client receives a complete response and not a 5xx or a reset, and a daemon that exits early FAILS the gate. Anti-vacuity tooth required -- a run in which no request was in flight when TERM landed must be reported as UNOBSERVED and must not score as a pass	Organ	1 u
Front door that never restarts during a deploy (TS3) after TS1,TS2	ts_slot_flip	Two backend slots on two ports behind one small front door that owns the upstream choice and is independent of both. ACCEPT RULE: a flip changes which slot answers with zero failed requests across the flip, a slot that fails its warm-up probe is NEVER flipped to, and the front door's own uptime is unbroken across the whole exercise. The front door is the only component in this domain that must never restart, so its own replacement is TS1's problem and is a stated dependency, not an afterthought	Organ	1.5 u
Mirror to a shadow port and discard the response (TS4) after TS3	ts_mirror_shadow	Each incoming request is copied to a shadow instance whose response is discarded and never reaches the client. ACCEPT RULE: over a declared number of mirrored requests the client-visible responses are byte-identical to the un-mirrored control, the shadow's responses are proven discarded, and a shadow that returns errors or hangs changes NOTHING the client sees -- proven by killing the shadow mid-run and observing no client-visible effect	Organ	2 u
Bake with a minimum request denominator (TS5) after TS3	ts_bake_window	A promoted candidate is held under observation for a declared window that advances only after a declared minimum number of real requests. ACCEPT RULE: a window that saw fewer than the minimum reports UNOBSERVED and REFUSES to promote rather than passing -- the gate-passes-on-the-empty-set defect is the specific thing this rung exists to make impossible -- and the third state is distinct from both pass and fail in the exit code, not only in the text	Organ	1 u
Rollback fired by the capability-loss oracle (TS6) after TS5	ts_rollback_on_caploss	The oracles that already exist drive an automatic revert to the previous process. ACCEPT RULE, all four required and each with its own tooth: a two-window burn-rate signal whose short window demonstrably stops the action latching after recovery, a bounded number of automatic actions per unit time proven by a flapping-input fixture that must NOT produce unbounded reverts, a minimum-request denominator, and a time-boxed off switch that AUTO-RE-ARMS -- proven by disabling it and observing it re-arm without a human. A flapping input that drives repeated reverts is a RED, because that failure mode is the one that caused the outage this rung cites	Organ	2 u
The undo path does not traverse the subject (TS7) after TS3	ts_undo_independence	A gate resolves the dependency chain of the rollback ACTION -- which process serves it, which route reaches it, which daemon authenticates it -- and REFUSES when any link passes through the component being rolled back. ACCEPT RULE: run against TODAY's topology it must go RED and NAME sites.elf, because the undo route demonstrably crosses the front door; run against a topology where the undo path is independent it must go GREEN. A gate that cannot go RED on the current estate is vacuous by construction and must not be shipped	Organ	1 u
Request-path admission and shedding (TS8)	ioa_request_admit	The existing shared admission ruler gains a request-path verdict so a saturated box sheds EARLY rather than accepting work it cannot finish. ACCEPT RULE: shedding is proven to preserve goodput against an un-shed control at the same offered load, and the shed response is a non-retryable error class rather than one that invites a retry. Extends the incumbent ruler -- a second admission ruler is refused by construction	Organ	1.5 u
Wait hints derived from the real bound (TS9)	ts_retry_after_derived	Any advertised wait is derived from the SAME named constant as the resource it waits on, emitted as a machine-readable header, and jittered on emission. ACCEPT RULE: changing the lock TTL constant changes the advertised value with no second edit -- proven by changing it and re-reading the emission -- and a resource with no bounded recovery advertises a non-retryable class and NO wait hint at all	Organ	0.5 u
Tell the peer what was processed (TS10) after TS2	ts_goaway_lastid	Graceful shutdown announces the last request the server may have acted on so the client can decide retry-safety instead of guessing. ACCEPT RULE: a client that receives the announcement retries exactly the requests after that marker and no others. SCOPE DECLARED UP FRONT: the mechanism is HTTP/2 GOAWAY and our edge serves HTTP/1.1, so this rung carries a protocol prerequisite and is priced with it rather than promised without it	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
M1 · A deploy nobody sees	TS1,TS2,TS3	4.5 u
M2 · A canary that serves nobody and an undo we can trust	TS4,TS5,TS6,TS7	9.5 u
M3 · The request path and the protocol	TS8,TS9,TS10,TS11	14.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
No retry advice when the outcome is unknown (TS11) after TS9	er_read_after_accept	A refusal emitted after the backend ACCEPTED an unsafe request and then went silent must NOT advise a retry, because the write may already have committed and the outcome is UNKNOWN rather than unavailable. ACCEPT RULE, both directions required and neither sufficient alone: an unsafe method on the accepted-then-silent stage is answered with a non-retryable class carrying NO wait hint, AND a safe method on that identical stage still receives its ordinary retryable 503 -- a guard that suppresses the advice for everything satisfies the first conjunct and must FAIL the second. The decision lives in ONE ruler imported by both the emitting daemon and the gate so the two cannot disagree about what an unsafe method is; a second copy of the method test is refused by construction. LANDED and gate-proven 15 of 15 with eight named negative controls; SCOPE DECLARED: the teeth prove the DECISION and not the WIRING, which is evidenced separately by the symbol resolving at the front door call site. Completes the second conjunct of TS9, which pre-declared that a resource with no bounded recovery advertises a non-retryable class and no wait hint -- this rung answers the harder neighbouring condition, where recovery is not merely unbounded but the outcome is unknowable	Organ	0 u
Status analytics and the non-empty-200 SLA gauge (TS11) after method	nx_statuscensus	OPERATOR 2026-09-05: analytics on every response status the estate returns -- 200, 404, 503, every other code, and UNDEFINED (a request that got NO status: the dropped-receipt class) -- and a gauge that holds the front door to 99 percent and above 200s WITH a confirmed non-empty expected body. DONE-RULE, pre-declared: (1) the edge writes ONE row per response it sends, synthesized ones included, to a truncate-rotated status journal (ts	lane	route u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 13. Rank input binding: STALE_INCONSISTENT. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 17104e518e0b1614eb4a7dfea83d5c0eba837456438a583d150746e6ed56da45. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Invalid declared graph. Malformed rows or IDs 1; duplicate IDs 0; duplicate prerequisites 0; missing prerequisites 0; cyclic or cycle-dependent nodes 0. Node paths withheld.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence trafficsafety writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

TS0 Capability-loss oracle on promote · cell PRESENT · gate NO-GATE-DECLARED

Contract	`rg_missing` · executor Organ · 0 u · stands on nothing
Definition of done	Every route the live binary serves is extracted and each one the candidate does not carry is NAMED before promote -- LANDED, and the exceed this domain holds
Matrix cell	Promote refused when the candidate serves fewer routes than live · `runtime/_hdl_build/nx_routeguard_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_routeguard_lib`; declare `nx_routeguard_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

TS1 Keep the socket replace the process · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ts_handoff_nodrop` · executor Organ · 2 u · stands on nothing
Definition of done	An owner outside the serving process holds the listener and hands it to each generation, so the port never disappears and arrivals queue rather than being refused. ACCEPT RULE PRE-DECLARED, and it is the estate's own already-written bar: a swap under a synthetic request stream drops ZERO connections, measured by a client that counts refusals and resets, not by the daemon's own log. The neg-control is mandatory -- the same harness against the CURRENT ordinary-listener path must show a non-zero drop, or the test proves nothing. Blocked on sys_sendmsg for the SCM_RIGHTS form, so the socket-activation form ships first and the blocker is named in the row
Matrix cell	Zero dropped connections across a process swap · `runtime/nx_http_server.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_http_server`; declare `nx_http_server TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

TS2 Cooperative drain on TERM with a named deadline · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ts_drain_on_term` · executor Organ · 1 u · stands on TS1
Definition of done	On TERM the daemon STOPS ACCEPTING and KEEPS SERVING in-flight requests until a declared deadline, then exits; the deadline is a named constant, never a literal. ACCEPT RULE: with a request in flight at the moment TERM lands, the client receives a complete response and not a 5xx or a reset, and a daemon that exits early FAILS the gate. Anti-vacuity tooth required -- a run in which no request was in flight when TERM landed must be reported as UNOBSERVED and must not score as a pass
Matrix cell	Cooperative drain keep serving after TERM until a named deadline · `runtime/nx_ts_drain_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ts_drain_lib`; declare `nx_ts_drain_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

TS3 Front door that never restarts during a deploy · cell PRESENT · gate UNRECORDED

Contract	`ts_slot_flip` · executor Organ · 1.5 u · stands on TS1, TS2
Definition of done	Two backend slots on two ports behind one small front door that owns the upstream choice and is independent of both. ACCEPT RULE: a flip changes which slot answers with zero failed requests across the flip, a slot that fails its warm-up probe is NEVER flipped to, and the front door's own uptime is unbroken across the whole exercise. The front door is the only component in this domain that must never restart, so its own replacement is TS1's problem and is a stated dependency, not an afterthought
Matrix cell	Blue-green behind a front door that never restarts · `runtime/nx_ts_slot_lib.nx` · PRESENT decl
Gate	`nx_ts_slot_router_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

TS4 Mirror to a shadow port and discard the response · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ts_mirror_shadow` · executor Organ · 2 u · stands on TS3
Definition of done	Each incoming request is copied to a shadow instance whose response is discarded and never reaches the client. ACCEPT RULE: over a declared number of mirrored requests the client-visible responses are byte-identical to the un-mirrored control, the shadow's responses are proven discarded, and a shadow that returns errors or hangs changes NOTHING the client sees -- proven by killing the shadow mid-run and observing no client-visible effect
Matrix cell	Mirror to a shadow port and discard the response · `runtime/_hdl_build/nx_proxy_route.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_proxy_route`; declare `nx_proxy_route TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

TS5 Bake with a minimum request denominator · cell WATCHING · gate UNRECORDED

Contract	`ts_bake_window` · executor Organ · 1 u · stands on TS3
Definition of done	A promoted candidate is held under observation for a declared window that advances only after a declared minimum number of real requests. ACCEPT RULE: a window that saw fewer than the minimum reports UNOBSERVED and REFUSES to promote rather than passing -- the gate-passes-on-the-empty-set defect is the specific thing this rung exists to make impossible -- and the third state is distinct from both pass and fail in the exit code, not only in the text
Matrix cell	Bake with a minimum request denominator before promoting · `runtime/_hdl_build/nx_mgmt_api.nx` · WATCHING decl
Gate	`nx_mgmt_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_mgmt_gaterun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

TS6 Rollback fired by the capability-loss oracle · cell WATCHING · gate UNRECORDED

Contract	`ts_rollback_on_caploss` · executor Organ · 2 u · stands on TS5
Definition of done	The oracles that already exist drive an automatic revert to the previous process. ACCEPT RULE, all four required and each with its own tooth: a two-window burn-rate signal whose short window demonstrably stops the action latching after recovery, a bounded number of automatic actions per unit time proven by a flapping-input fixture that must NOT produce unbounded reverts, a minimum-request denominator, and a time-boxed off switch that AUTO-RE-ARMS -- proven by disabling it and observing it re-arm without a human. A flapping input that drives repeated reverts is a RED, because that failure mode is the one that caused the outage this rung cites
Matrix cell	Automated rollback triggered on capability loss · `runtime/_hdl_build/nx_mgmt_api.nx` · WATCHING decl
Gate	`nx_mgmt_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_mgmt_gaterun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

TS7 The undo path does not traverse the subject · cell WATCHING · gate UNRECORDED

Contract	`ts_undo_independence` · executor Organ · 1 u · stands on TS3
Definition of done	A gate resolves the dependency chain of the rollback ACTION -- which process serves it, which route reaches it, which daemon authenticates it -- and REFUSES when any link passes through the component being rolled back. ACCEPT RULE: run against TODAY's topology it must go RED and NAME sites.elf, because the undo route demonstrably crosses the front door; run against a topology where the undo path is independent it must go GREEN. A gate that cannot go RED on the current estate is vacuous by construction and must not be shipped
Matrix cell	The undo path is proven not to traverse the subject · `runtime/_hdl_build/nx_mgmt_api.nx` · WATCHING decl
Gate	`nx_mgmt_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_mgmt_gaterun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

TS8 Request-path admission and shedding · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ioa_request_admit` · executor Organ · 1.5 u · stands on nothing
Definition of done	The existing shared admission ruler gains a request-path verdict so a saturated box sheds EARLY rather than accepting work it cannot finish. ACCEPT RULE: shedding is proven to preserve goodput against an un-shed control at the same offered load, and the shed response is a non-retryable error class rather than one that invites a retry. Extends the incumbent ruler -- a second admission ruler is refused by construction
Matrix cell	Request-path admission and load shedding · `runtime/nx_ioadmit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_ioadmit_lib`; declare `nx_ioadmit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

TS9 Wait hints derived from the real bound · cell PRESENT · gate UNRECORDED

Contract	`ts_retry_after_derived` · executor Organ · 0.5 u · stands on nothing
Definition of done	Any advertised wait is derived from the SAME named constant as the resource it waits on, emitted as a machine-readable header, and jittered on emission. ACCEPT RULE: changing the lock TTL constant changes the advertised value with no second edit -- proven by changing it and re-reading the emission -- and a resource with no bounded recovery advertises a non-retryable class and NO wait hint at all
Matrix cell	Wait hints derived from the real recovery bound · `runtime/_hdl_build/nx_mgmt_api.nx` · PRESENT decl
Gate	`nx_mgmt_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_mgmt_gaterun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

TS10 Tell the peer what was processed · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ts_goaway_lastid` · executor Organ · 3 u · stands on TS2
Definition of done	Graceful shutdown announces the last request the server may have acted on so the client can decide retry-safety instead of guessing. ACCEPT RULE: a client that receives the announcement retries exactly the requests after that marker and no others. SCOPE DECLARED UP FRONT: the mechanism is HTTP/2 GOAWAY and our edge serves HTTP/1.1, so this rung carries a protocol prerequisite and is priced with it rather than promised without it
Matrix cell	Tell the peer which requests were processed before closing · `runtime/nx_http_server.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_http_server`; declare `nx_http_server TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 land SEV-9 (debt 1788630978, operator 2026-09-05 'address it so we dont have unclear deploys'): THE FRONT DOOR DROPPED THE RECEIPT OF UNSAFE CALLS UNDER A STORM. Mechanism read from nx_tools_api.nx: the ASYNC JOB LANE reserved the job id, wrote the claim and forked the runner, then sys_wait4()ed the middle child and appended the fsync'd actlog row BEFORE building its JOB-STARTED reply -- on a storming array that bookkeeping outlived the 15000 ms edge window, sites.elf synthesised 503 Outcome-Unknown, and the reserved id (the only handle to the outcome) was never delivered while the job ran anyway. The PROMOTE lane had this exact fix since debt 1787505278 (announce the id first, park the bookkeeping, drain after the reply is on the wire); the sibling lane did not -- half a law, and the half every seat's writes ride. Measured today: 7 dropped receipts, 6 had landed; one self-anchored insert issued twice ended at ONE copy by luck. SOURCE FIX LANDED: nx_tools_api.nx +ta_ap_* statics, ta_async_pending(), ta_async_finish() (reap + actlog), the async lane REPLIES FIRST under ta_defer_ok and parks pid1/name/jid/t0 (pure-bytes gate callers keep the inline order byte-for-byte); nx_tools_api_serve.nx calls ta_async_finish() right after ta_promote_finish(). BUILT nx_tools_api_serve 263222 B sha 991b2522 (staged nx_tools_api_serve.sov.elf.new, src_stable=1). NOT DEPLOYED: this is the transport every seat rides and an 8-minute blackout is on record for this daemon's startup path -> health-checked /api/deploy on a CALM box with the live binary banked by hash and an operator go. OPEN halves of the same row: a caller nonce (_nonce=) matched durably beside the job id so a same-nonce re-issue returns the ORIGINAL outcome (this rung's retry-safety announcement in its HTTP/1.1 form), and the edge carrying the reserved id inside its 503 body. Companion defect: /api/build's cache served a STALE artifact with an unchanged output sha across a changed src three times today (debt 1788629238) -- a BUILT receipt can name a binary that is not the source; verify staged bytes by content, nx_sov_build_run's cache key was honest each time.

TS11 No retry advice when the outcome is unknown · cell PRESENT · gate NO-GATE-DECLARED

Contract	`er_read_after_accept` · executor Organ · 0 u · stands on TS9
Definition of done	A refusal emitted after the backend ACCEPTED an unsafe request and then went silent must NOT advise a retry, because the write may already have committed and the outcome is UNKNOWN rather than unavailable. ACCEPT RULE, both directions required and neither sufficient alone: an unsafe method on the accepted-then-silent stage is answered with a non-retryable class carrying NO wait hint, AND a safe method on that identical stage still receives its ordinary retryable 503 -- a guard that suppresses the advice for everything satisfies the first conjunct and must FAIL the second. The decision lives in ONE ruler imported by both the emitting daemon and the gate so the two cannot disagree about what an unsafe method is; a second copy of the method test is refused by construction. LANDED and gate-proven 15 of 15 with eight named negative controls; SCOPE DECLARED: the teeth prove the DECISION and not the WIRING, which is evidenced separately by the symbol resolving at the front door call site. Completes the second conjunct of TS9, which pre-declared that a resource with no bounded recovery advertises a non-retryable class and no wait hint -- this rung answers the harder neighbouring condition, where recovery is not merely unbounded but the outcome is unknowable
Matrix cell	No retry advice when the outcome is unknown · `runtime/nx_edge_refusal_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_edge_refusal_lib`; declare `nx_edge_refusal_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 land nx_statuscensus source LANDED in buildroot/runtime: nx_statuscensus_lib.nx (16859 B, the ONE classifier -- edge sites_telemetry.log tail window into the partition DELIVERED / EMPTY / 404 / SYNTH-5xx / UNDEFINED (rc<0, no HTTP status) plus a separate proxied-unstatused axis for vh=70 rows whose backend status the edge never journals; actlog.jrnl into DELIVERED / EMPTY / ERROR / RECEIPT; SLA permil = delivered over ALL rows so an empty 200 is not a delivery; a window under min_rows is UNOBSERVED and never votes; level truncate-written to knowledge/status/statuscensus.status with verdict= as the LAST line, trajectory appended to knowledge/status/statuscensus.log), nx_statuscensus.nx (1687 B program, bars from knowledge/statuscensus.conf, defaults announced src=default), nx_statuscensus_gate.nx (10935 B: four in-process fixture runs RED / GREEN-with-absent-journal / UNOBSERVED / tail-window, three neg-controls, every number asserted and emitted via gv_check_eq). Builds QUEUED by admission under the I/O storm (BQ-nx_statuscensus_gate, BQ-nx_statuscensus). Next: gate GREEN on the NAS, promote + register + nx_offc_install, a clock row running the census, the first live status row, then the watch flips and the emitter renders it. Owed after that: a st=<code> field on nx_telemetry_emit so proxied replies stop reading as delivered-by-bytes. 2026-09-05 measure nx_statuscensus_gate BUILT on the sov lane (51784 B, daa41c9d), PROMOTED, REGISTERED, first run on the NAS = 35/35 GREEN: fixture A every bucket by value (edge 10 rows -> delivered 6 / empty 1 / 404 1 / synth-5xx 1 / UNDEFINED 1, partition sums, proxied-unstatused 1 on its own axis, sla 600 permil; tools 7 rows -> delivered 4 / empty 1 / error 1 / receipt 1, sla 571), B GREEN with the tools journal ABSENT (that axis reads UNOBSERVED with permil -1, never zero rows), C UNOBSERVED under min_rows (rc 3, no vote), D a tail window five bytes short skips the cut first row and announces its byte count; neg-controls: a synthesized 503 with a body is not delivered, rc<0 with a body and vh=71 is UNDEFINED not synth, an error exit with a body is an error. Next: promote the program (staged 5c0eded2), register, first live status row, clock beat. 2026-09-05 measure FIRST LIVE STATUS CENSUS (nx_statuscensus PROMOTED 5c0eded2, REGISTERED, run 1788635835, window 8 MiB = the last ~day, bars from knowledge/statuscensus.conf src=conf): EDGE 165947 connections -> delivered 118879 (716 permil) / empty 2874 / 404 11175 / synth-5xx 1269 / UNDEFINED 31750 (TLS handshakes that never reached HTTP), partition sums; proxied-unstatused 78037 on its own axis = the size of the blind spot until nx_telemetry_emit carries st=<code>; edge SLA 716 permil against the 990 bar = RED. TOOLS API 76934 calls -> delivered 46245 (601 permil) / empty 4 / error 15112 / async receipts 15573 (counted as NOT confirmed delivery until their _jobs artifact is joined -- TS12 owed), act SLA 601 permil = RED. verdict=RED, level written to knowledge/status/statuscensus.status (verdict last line), trajectory row appended to knowledge/status/statuscensus.log. Clock row statuscensus every 3600 s declared (nx_clockjob put; folds into the live plane at the scheduler's next window-init). The watch row on this board flips on the next regen. Worklist the numbers name, largest first: (1) st= on the edge emitter so 78037 proxied rows stop reading as delivered-by-bytes; (2) the UNDEFINED class -- classify handshake failures (scanner, aborted, TLS version) before treating them as SLA misses; (3) 404s at 67 permil of connections -- a top-paths census; (4) the 1269 synthesized 5xx are the sev-9 front-door drops (debt 1788630978, fix built, deploy owed); (5) tools-API errors 15112 -- an exit-code census by tool.

TS11 Status analytics and the non-empty-200 SLA gauge · cell LANDED · gate NO-GATE-DECLARED

Contract	`nx_statuscensus` · executor lane · route u · stands on method (UNRESOLVED: no such rung on this plan)
Definition of done	OPERATOR 2026-09-05: analytics on every response status the estate returns -- 200, 404, 503, every other code, and UNDEFINED (a request that got NO status: the dropped-receipt class) -- and a gauge that holds the front door to 99 percent and above 200s WITH a confirmed non-empty expected body. DONE-RULE, pre-declared: (1) the edge writes ONE row per response it sends, synthesized ones included, to a truncate-rotated status journal (ts
Matrix cell	Status analytics and the non-empty-200 SLA gauge · `runtime/nx_statuscensus.nx` · LANDED exists
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_statuscensus`; declare `nx_statuscensus TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 land nx_statuscensus source LANDED in buildroot/runtime: nx_statuscensus_lib.nx (16859 B, the ONE classifier -- edge sites_telemetry.log tail window into the partition DELIVERED / EMPTY / 404 / SYNTH-5xx / UNDEFINED (rc<0, no HTTP status) plus a separate proxied-unstatused axis for vh=70 rows whose backend status the edge never journals; actlog.jrnl into DELIVERED / EMPTY / ERROR / RECEIPT; SLA permil = delivered over ALL rows so an empty 200 is not a delivery; a window under min_rows is UNOBSERVED and never votes; level truncate-written to knowledge/status/statuscensus.status with verdict= as the LAST line, trajectory appended to knowledge/status/statuscensus.log), nx_statuscensus.nx (1687 B program, bars from knowledge/statuscensus.conf, defaults announced src=default), nx_statuscensus_gate.nx (10935 B: four in-process fixture runs RED / GREEN-with-absent-journal / UNOBSERVED / tail-window, three neg-controls, every number asserted and emitted via gv_check_eq). Builds QUEUED by admission under the I/O storm (BQ-nx_statuscensus_gate, BQ-nx_statuscensus). Next: gate GREEN on the NAS, promote + register + nx_offc_install, a clock row running the census, the first live status row, then the watch flips and the emitter renders it. Owed after that: a st=<code> field on nx_telemetry_emit so proxied replies stop reading as delivered-by-bytes. 2026-09-05 measure nx_statuscensus_gate BUILT on the sov lane (51784 B, daa41c9d), PROMOTED, REGISTERED, first run on the NAS = 35/35 GREEN: fixture A every bucket by value (edge 10 rows -> delivered 6 / empty 1 / 404 1 / synth-5xx 1 / UNDEFINED 1, partition sums, proxied-unstatused 1 on its own axis, sla 600 permil; tools 7 rows -> delivered 4 / empty 1 / error 1 / receipt 1, sla 571), B GREEN with the tools journal ABSENT (that axis reads UNOBSERVED with permil -1, never zero rows), C UNOBSERVED under min_rows (rc 3, no vote), D a tail window five bytes short skips the cut first row and announces its byte count; neg-controls: a synthesized 503 with a body is not delivered, rc<0 with a body and vh=71 is UNDEFINED not synth, an error exit with a body is an error. Next: promote the program (staged 5c0eded2), register, first live status row, clock beat. 2026-09-05 measure FIRST LIVE STATUS CENSUS (nx_statuscensus PROMOTED 5c0eded2, REGISTERED, run 1788635835, window 8 MiB = the last ~day, bars from knowledge/statuscensus.conf src=conf): EDGE 165947 connections -> delivered 118879 (716 permil) / empty 2874 / 404 11175 / synth-5xx 1269 / UNDEFINED 31750 (TLS handshakes that never reached HTTP), partition sums; proxied-unstatused 78037 on its own axis = the size of the blind spot until nx_telemetry_emit carries st=<code>; edge SLA 716 permil against the 990 bar = RED. TOOLS API 76934 calls -> delivered 46245 (601 permil) / empty 4 / error 15112 / async receipts 15573 (counted as NOT confirmed delivery until their _jobs artifact is joined -- TS12 owed), act SLA 601 permil = RED. verdict=RED, level written to knowledge/status/statuscensus.status (verdict last line), trajectory row appended to knowledge/status/statuscensus.log. Clock row statuscensus every 3600 s declared (nx_clockjob put; folds into the live plane at the scheduler's next window-init). The watch row on this board flips on the next regen. Worklist the numbers name, largest first: (1) st= on the edge emitter so 78037 proxied rows stop reading as delivered-by-bytes; (2) the UNDEFINED class -- classify handshake failures (scanner, aborted, TLS version) before treating them as SLA misses; (3) 404s at 67 permil of connections -- a top-paths census; (4) the 1269 synthesized 5xx are the sev-9 front-door drops (debt 1788630978, fix built, deploy owed); (5) tools-API errors 15112 -- an exit-code census by tool.

dossiers=13 cells_joined=13 no_matrix_row=0 (sum 13) gates_recorded=0 gates_unrecorded=5 no_gate_declared=8 (sum 13 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 25 feature rows mapped of 25 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/trafficsafety.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 400–1000, distinctiveness 150–400 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 655 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 400–1000 · distinctiveness 150–400 · breadth 250–600 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 422 permil of the plot

Nishi nginx HAProxy Envoy ArgoRollouts
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 12 (a fact of the data: two players that close are that close) · data spread 622 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	800	333	493	685	-41 since 2026-09-23	18	10	2026-09-15
nginx	Mainstream	842	190	440	785	+9 since 2026-09-23	14	10	2026-09-15
HAProxy	Mainstream	842	190	440	785	+9 since 2026-09-23	14	10	2026-09-15
Envoy	Aspirational	871	333	546	911	+9 since 2026-09-23	15	10	2026-09-15
ArgoRollouts	Unconventional	471	351	293	814	+11 since 2026-09-23	9	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	25	5
2026-09-16	25	5
2026-09-17	25	5
2026-09-18	25	5
2026-09-19	25	5
2026-09-20	25	5
2026-09-21	25	5
2026-09-22	25	5
2026-09-23	25	5
2026-10-08	25	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 100, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	nginx	HAProxy	Envoy	ArgoRollouts
Hot listener a second process can hold the port while the old still serves Measured: `nx_http_server_listen_hot` exists in `runtime/nx_http_server.nx`, verified at emit. nginx inherits the descriptor across fork and both generations accept at once [nginx-binary-upgrade]. HAProxy transfers the actual listening file descriptors over SCM_RIGHTS so the socket is never closed and never re-bound [haproxy-seamless-reload]. Envoy asks for copies of the listen sockets only after the new process has fully initialized [envoy-hot-restart]. Ours is SO_REUSEPORT co-binding, and the mgmt API's own adoption comment records nx_hotlisten_gate at 3 of 3 with T1 as the non-vacuity control -- a standard listener REFUSES the second bind, so the disease state is proven reachable before the cure is credited. HONEST SCOPE AND IT IS THE POINT OF THIS PAGE: LWN documents SO_REUSEPORT as carrying a DEFECT that drops connections during the three-way handshake when the listening set changes, so this proves the NECESSARY condition of two binders and never the sufficient one of zero drops [so-reuseport-lwn]. ADOPTION MEASURED FULL POPULATION at corpus_complete=1: 9 references estate-wide of which exactly 2 were production call sites when this page was admitted, nx_mgmt_api and nx_tools_api_serve, and BOTH of those hold a SO_REUSEPORT co-bind rather than a handoff. As of 2026-08-21 there are THREE, and the third is the only one that is a true HANDOFF: nx_survey_daemon calls ts_handoff_nodrop, proven in dropped connections across a real restart by nx_survey_handoff_gate 12/12. So the count understates the change and the KIND is the part that matters. The sites.elf front door every request crosses is still not one of them, and that is rung TS3 rather than an oversight. Adoption: `LIB-WIRED importers=88 nonval=72` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRollouts; fully adopted on the estate ladderCons behind nginx (leads), HAProxy (leads), Envoy (leads)	●	◉	◉	◉	○
Listener cannot be captured by a forked child Measured: `cx_is_cloexec` exists in `runtime/nx_cloexec_gate.nx`, verified at emit. Five teeth with T1 as the CONTROL -- a raw socket must read the FD_CLOEXEC bit CLEAR, so a kernel that set it by default could not fake a pass -- and a neg-control on the reader itself. THE OUTAGE IT EXISTS FOR, measured live 2026-07-30: /api/deploy forked nx_hostctl from inside nx_mgmt_api while mgmt held its listening socket with no FD_CLOEXEC, hostctl inherited the descriptor, and being the long-lived supervisor it held mgmt's port FOREVER and re-leaked it into every child it spawned -- an outage that SURVIVES EVERY RESTART and reads as a causeless crash-loop. DELIBERATELY NOT CLAIMED AS AN EXCEED: the three proxies never re-bind, so a child capturing the listener is not a hazard their design can produce, and absence of the test is not absence of the property. AND IT BOUNDS THE ROW ABOVE -- the kernel permits co-binding only when EVERY socket on the port set SO_REUSEPORT, so one inherited legacy socket locks out even a REUSEPORT binder. Adoption: `GATE:LIVE trial=GREEN` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Promote refused when the candidate serves fewer routes than live Source present; authored stronger claim: `rg_missing` in `runtime/_hdl_build/nx_routeguard_lib.nx`, verified at emit. EXCEED. THE FIELD ROLLS BACK ON AVAILABILITY PROXIES AND NOTHING ELSE -- Argo aborts on metric success conditions [argo-rollouts-analysis] and Google's canary service states the limit outright, asking whether the canary is meaningfully worse and NOT trying to establish absolute health, with good health metrics surprisingly rare [cas-canary-analysis]. A build that answers 200 to everything while having silently stopped serving /api/promote is invisible to every one of the four columns. rg_missing extracts every route literal from the LIVE binary and NAMES each one the candidate does not carry, before the promote. Built after the regression happened five measured times, one of them the author's own. Adoption: `LIB-WIRED importers=16 nonval=15` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of nginx, HAProxy, Envoy, ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Route-set shrink detected across a deploy transactionally Measured: `rd_in_baseline` exists in `runtime/_hdl_build/nx_route_diff.nx`, verified at emit. The DETECTION half of the same capability and deliberately NOT a second exceed claim -- snapshot the served route set before a deploy, check after, and ANY route absent versus the captured baseline is named. It complements rg_missing which compares BINARIES before promote where this compares the SERVED SET after, so the two answer different questions about the same defect. REPOINT NOT DUPLICATE: /compare/failmodes owns the general capability-loss oracle as cd_contains and this row is the routing instance of it. The class it was built for is concrete -- routes such as /api/promote and /tools/register and /cap/mint silently vanishing on a deploy, nine debt rows in one week. Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Two daemons listening on one port detected Measured: `pd_scan` exists in `runtime/_hdl_build/nx_portdup.nx`, verified at emit. The wrong-answer machine: on 2026-07-30 nx_mgmt_api AND nx_opaque_login were both LISTENING on 127.0.0.1:18098 and the kernel handed each connection to whichever accepted first, so the service answered correctly some of the time. AND THIS DOMAIN MUST NAME THE TENSION RATHER THAN INHERIT IT: a CORRECT hot handoff is two processes listening on one port BY DESIGN, so this detector and the mechanism in the first row disagree by construction. The organ already knows half of it -- its own header records that the neighbouring Synology nginx runs SO_REUSEPORT worker pools showing eight legitimate holders per port -- but nothing yet distinguishes a handoff overlap from a squat, and that discrimination is owed by rung TS1. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRolloutsCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	○
Listening-versus-claimed audit for every declared daemon port Measured: `pa_audit_conf` exists in `runtime/nx_port_audit.nx`, verified at emit. Parses /proc/net/tcp for sockets in LISTEN state and checks each port declared in knowledge/status/portmap.conf: is something ACTUALLY listening, or does the pidfile merely CLAIM up. This is the detector for the open deploy bind race that has twice left a service down with a HEALTHY binary. Coded zero across the field for a stated reason and not by oversight -- none of the three proxies can have this defect because none of them closes the listening socket, so the honest reading is that we built a detector for a hazard our design creates and theirs does not. The remedy is the row above this one, not a better detector. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRolloutsCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	○	○	○
Liveness probe whose every failure names its own failing conjunct Measured: `hp_run` exists in `runtime/nx_http_probe_lib.nx`, verified at emit. Thirteen distinct exit codes -- connect-failed, pattern-absent, status-not-2xx, recv-timeout, send-failed, body-truncated, empty-response, not-http and more -- so a compound health assertion cannot fail without saying WHICH half failed, which is the difference between a verdict and a diagnosis. Envoy is Best on health-checking depth. It also stamps a dead-man heartbeat so the PROBE's own failure is observable, and it retired a curl-and-grep cron one-liner that was the estate's only compensating control over a fail-open authentication path and whose own failure was structurally unobservable. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Envoy (leads)	●	●	●	◉	●
Public-site liveness verdict written where a rollup reads it Measured: `sl_check` exists in `runtime/_hdl_build/nx_site_liveness.nx`, verified at emit. Probes each public site for HTTP 200 plus a body plus the X-Served-By edge marker over the sovereign fetcher, and appends verdict GREEN or RED to a log the maturity rollup reads. Presence, not depth, and the wired-state is stated rather than implied: the organ is REGISTERED-DARK -- promoted, registered, authorised, with no invocation on record. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Reachability measured from a second vantage that does not share fate Measured: `ev_has` exists in `runtime/_hdl_build/nx_edge_vantage.nx`, verified at emit. AWS states the requirement plainly -- monitor from a second adjacent Region, which is more representative of the end user's experience and reduces the risk of the application and its monitoring being impaired by the same event [arc-dataplane-recovery]. Ours probes the public edge from off-LAN over our own TLS 1.3 stack, and that matters here because PORT REACHABILITY IS A PROPERTY OF THE VANTAGE and not of the host: on-LAN 443 is closed and 8443 open, off-LAN the reverse, so a single-vantage check calls a healthy host down. NOT AN EXCEED AND THE ZEROES SAY WHY -- the four columns are three proxies and a rollout controller, none of which is a monitoring product, so a zero here is a scope statement and not a lead. Cloudflare and AWS do this and are deliberately outside this column set. Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRolloutsCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	○	○	○
Route table is data rather than a recompiled branch Measured: `pr_lookup` exists in `runtime/_hdl_build/nx_proxy_route.nx`, verified at emit. 69 live rows over 4 hostnames and roughly 35 backend ports map host plus path-prefix to a port and a mode, longest-prefix wins, exact host beats the wildcard, and the prefix test is segment-boundary-safe so /gen never matches /generated. All three proxies are Best -- this is their core competence. TWO SAFETY FACTS READ OUT OF THE LIVE FILE. First, mode=gated means fail-closed 302 to /login when the BACKEND IS DOWN and is NOT authentication, so routing an unauthenticated daemon as gated publishes it. Second and sharper: pr_mode recognises only stream and gated and returns BUFFERED for every other token, so a mistyped fail-closed keyword silently downgrades a gated route to buffered with no diagnostic -- and the live table already contains one row whose mode field is a bare 0 rather than any of the three documented names, which is the witness that non-vocabulary tokens do reach this file. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRollouts; fully adopted on the estate ladderCons behind nginx (leads), HAProxy (leads), Envoy (leads)	●	◉	◉	◉	○
SNI routing without terminating TLS and malformation falls to a default Measured: `sni_backend` exists in `runtime/nx_sni_route.nx`, verified at emit. Pure -- no syscalls and no imports -- so it is unit-gateable offline against hand-crafted ClientHellos, and every offset into untrusted network bytes is bounds-checked with any malformation routing to the DEFAULT backend rather than refusing, which is fail-SAFE rather than fail-closed and is the right choice for a front door. All three proxies do SNI routing and are Best. REPOINT: /compare/deploy and /compare/authz already carry this organ as the sovereign-TLS exceed row, and here it is scored only for its ROUTING safety property, which neither of those pages measures. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRollouts; fully adopted on the estate ladderCons behind nginx (leads), HAProxy (leads), Envoy (leads)	●	◉	◉	◉	○
Signed daemon registry with health-probed respawn Open — no implementing organ is measured for this axis yet. A daemon is a REGISTRY ROW read hot every 15-second cycle, each probed by a health probe that distinguishes SERVING from HUNG from REFUSED and so catches the wedge a pidfile-or-port check misses, and the registry is signature-verified so a tampered file fail-closed holds last-good. THE MEASURED DANGER LIVES IN THE SAME ORGAN: its wedge-kill is what converted the 8-minute blackout from slow into unrecoverable, because every kill discarded a partially-completed startup and re-queued a fresh instance behind the same lock. Kubernetes has exactly one kubelet per node with restart authority and its startup probe exists precisely so a slow start is not read as death [k8s-probes]. Nothing here refuses a second supervisor, and two of them owned nx_tools_api at once during that incident. Pros none measured yetCons behind nginx, HAProxy, Envoy, ArgoRollouts; no implementing organ measured	○	●	●	●	●
Scheduled-job heartbeat with an expected period and a grace window Measured: `cw_row_declares` exists in `runtime/_hdl_build/nx_cron_watch.nx`, verified at emit. The dead-man's-switch model -- a job pings on its own schedule and the watch reports STALE when the ping does not arrive inside period plus grace -- carried here only because the deploy, promote and rollback beats are traffic-safety machinery. Live at 17 watches and 0 stale as of this session. Coded zero across the field because none of the four columns watches cron; the monitoring-product comparison belongs to /compare/supervisor and is repointed, not restated. Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Request-path admission and load shedding DARK — `runtime/nx_ioadmit_lib.nx` EXISTS but does not declare `ioa_request_admit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. REPOINT NOT DUPLICATE, and the distinction is the whole row: /compare/loadgov owns HOST admission where ba_verdict and ioa_spawn_budget decide whether a compiler may FORK, on a D-state witness. NOTHING in the estate admits or sheds a REQUEST. Envoy is Best with five circuit-breaker threshold classes plus a retry budget expressed as a PERCENTAGE of live traffic, so retry load scales with success rather than with failure where a per-request cap of N multiplies under total outage [envoy-retry-budget], and its outlier ejection is bounded by max_ejection_percent so a global fault cannot make the detector eject the whole fleet [envoy-outlier-detection]. The contract deliberately extends the incumbent shared ruler rather than adding a second one. dossierwatching ioa_request_admit Pros none measured yetCons behind nginx, HAProxy, Envoy (leads); open contract; expected source declaration not established	○	●	●	◉	○
Zero dropped connections across a process swap Measured: `ts_handoff_nodrop` exists in `runtime/nx_http_server.nx`, verified at emit. THE INVARIANT, stated so it can be tested: there must be no instant at which zero processes hold the listening socket. THE ESTATE ALREADY DECLARED THIS RUNG AND ITS ACCEPT RULE AND HAS NEVER MET IT -- nx_pm_sclass_deploy carries the line A3 FD-passing zero-downtime hot-swap SCM_RIGHTS with the gate written as zero dropped connections across the swap, status ASSIGNED. HAProxy measured the unfixed version at 155 connection failures per million connections after 180 reloads and then removed the race entirely by MOVING the descriptor rather than re-binding it [haproxy-seamless-reload]. LANDED 2026-08-21 AND MEASURED IN DROPPED CONNECTIONS, NOT IN BINDERS. The blocker named here was real and is now gone: sys_sendmsg was ABSENT-PROVEN from all of buildroot/runtime at coverage_complete=1 and corpus_complete=1, and the shim now carries sendmsg, recvmsg and an SCM_RIGHTS send_fd and recv_fd whose struct offsets were read out of the platform headers rather than recalled. nx_scm_rights_gate proves a REAL listening socket moves between two REAL processes and keeps working after the original owner closes its copy, 14 of 14. nx_ts_handoff_gate then runs the accept rule itself in the socket-activation form, where an owner outside the service holds the listener and hands it to each generation so queued arrivals survive the restart [systemd-socket-activation]: ARMED 17 attempted, 17 served, ZERO drops, with the in-gap arrival connecting cleanly; NEG-CONTROL on the current bind-per-process path 17 attempted, 1 drop, the in-gap arrival refused with ECONNREFUSED. SCOPE STATED: that is the STRUCTURAL property, not a failure RATE -- no run of this size could see HAProxy's 155-per-million figure, which needs a load generator and a different instrument. TWO PATHS REACH THIS INVARIANT AND THE CONDITION THAT SELECTS BETWEEN THEM IS RECORDED HERE RATHER THAN ONE BEING TREATED AS SUPERSEDED. (a) ORDINARY FD INHERITANCE ACROSS execve, which is what systemd's LISTEN_FDS/LISTEN_PID contract is: the owner holds the bind and the generation inherits it, needing only fork, exec, dup2 and getenv -- every one of which this shim already had, so this path never needed sys_sendmsg at all. It satisfies the invariant BY CONSTRUCTION rather than by protocol, because the listener was never the process's to declare. (b) SCM_RIGHTS DESCRIPTOR PASSING, which is what nginx and HAProxy use and what shipped here. THE SELECTOR IS WHETHER THE SOCKET OWNER IS THE GENERATION'S PARENT: inheritance works only for a child the owner itself forked, and descriptor-passing is required for a peer it did not. OUR PRODUCTION CASE IS THE PEER CASE, measured from daemons.reg rather than assumed -- nx_daemon_supervisor and nx_hostctl fork the serving daemons, so a socket owner that is not the supervisor can never be their parent, and making it their parent would mean replacing the supervisor. BOTH PATHS ARE EXERCISED IN THIS ESTATE TODAY AND THE GATES ARE THE WITNESS: nx_ts_drain_gate's subject INHERITS its listener across a plain fork with no exec and no control message, while nx_survey_handoff_gate's adopted arm hands the descriptor across fork+EXECVE over SCM_RIGHTS. The inheritance path is cheaper and should be preferred wherever the owner forks the generation; it is not available to the adoption that shipped. Adoption: `LIB-WIRED importers=88 nonval=72` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRollouts; fully adopted on the estate ladderCons behind nginx (leads), HAProxy (leads), Envoy (leads)	●	◉	◉	◉	○
Cooperative drain keep serving after TERM until a named deadline Measured: `ts_drain_on_term` exists in `runtime/nx_ts_drain_lib.nx`, verified at emit. LANDED AND ADOPTED 2026-08-21, and the ORGAN PATH ON THIS ROW WAS CORRECTED BY MEASUREMENT RATHER THAN LEFT TO ROT. It named runtime/nx_signal.nx, where this symbol structurally CANNOT work and where this watch could therefore never have flipped: TARGET_X86_64 is hard-pinned undefined so the x86 backend emits through x86ctx_rv64_to_x86_64_syscall, whose default branch is a pass-through, and rv64 134 is not a key in that table -- so nx_signal's own nx_signal_action_install lands on x86 uselib and cannot install anything on the live target. The drain therefore lives in nx_ts_drain_lib beside the TS1 handoff it is a sibling of. IT DOES NOT INSTALL A HANDLER AT ALL, which is the deeper point: a handler that RETURNS needs SA_RESTORER on x86-64, and a delivered signal interrupts a blocking syscall with EINTR -- a read or write cut mid-response IS the truncated reply this rung exists to prevent, so the mechanism that NOTICES TERM must not be the mechanism that can CORRUPT the response. TERM is BLOCKED and consumed as a pollable descriptor, which buys both properties at once and makes an idle daemon exit the instant TERM arrives instead of sleeping out its budget. THE DEADLINE IS DERIVED, NEVER TYPED: every accepted connection already carries sys_set_socket_timeout(cfd, ACCEPT_TMO_S), so one in-flight request cannot outlive ACCEPT_TMO_S by construction and the drain deadline IS that same named constant -- rung TS9's principle applied one rung early, with knowledge/trafficsafety_drain.conf shipped deliberately EMPTY of a pinned row so the linkage cannot be broken by a second edit. PROVEN IN WHAT THE CLIENT RECEIVED, not in what the daemon logged: nx_ts_drain_gate 11/11, ARMED complete_response=1 killed_by_signal=0 with the request PROVABLY in flight when TERM landed, NEG-CONTROL on the identical harness complete_response=0 killed_by_signal=15. Bite-proven both directions -- unblocking the signal takes it 11/11 GREEN to 6/11 RED with the armed arm collapsing to the neg-control's exact signature, and the restore is byte-identical. Kubernetes states the race precisely: endpoint removal happens AT THE SAME TIME AS shutdown begins and not before it, so the only correct implementation is to keep serving after TERM and finish open connections [k8s-pod-termination]. AWS names the client-visible cost of getting it wrong -- a target that terminates the connection before the deregistration delay elapses makes the client receive a 500-level error, and the default delay is 300 seconds with early completion when the target is idle [alb-deregistration-delay]. MEASURED HERE FULL POPULATION at corpus_complete=1: rt_sigaction resolves 8 times across buildroot/runtime and every one is SIGPIPE handling, a crash handler, or the nx_signal library itself -- ZERO are a TERM drain in a serving daemon. The primitive exists and the adoption is nil. Envoy is honest about its own limit, implementing graceful draining for only four filter types so a plain TCP proxy hard-closes [envoy-draining]. Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind nginx (leads), HAProxy (leads), Envoy (leads)	●	◉	◉	◉	●
Blue-green behind a front door that never restarts Measured: `ts_slot_flip` exists in `runtime/nx_ts_slot_lib.nx`, verified at emit. LANDED 2026-08-21 AS A STANDALONE ROUTER, AND THE ORGAN PATH ON THIS ROW WAS MOVED OFF nx_proxy_route DELIBERATELY. That organ compiles into sites.elf, the front door all 69 route rows cross, so editing it to gain a deploy-safety property is the one change whose blast radius is every request in the estate -- the rung ships instead as nx_ts_slot_lib plus nx_ts_slot_router, fronting only throwaway slots, and adopting the pattern for the real front door is an operator decision to be taken AGAINST this evidence rather than smuggled in beneath it. ALL THREE CONJUNCTS OF THE ACCEPT RULE ARE TESTED SEPARATELY because a compound assertion that will not name its failing conjunct is a false-alarm generator: nx_ts_slot_router_gate 13/13 measured 48 attempted and 0 failed across a live flip, with 16 of 16 answered by slot A before it and 16 of 16 by slot B after; the front door was never restarted and was still the same live pid at the end; and a flip onto a slot whose server had been KILLED FOR REAL was REFUSED BY NAME with the active slot unmoved and 16 of 16 requests still reaching the healthy slot. The upstream choice is DATA re-read PER CONNECTION, so a flip takes effect on the next request with no signal, no restart and no reload race. IT INHERITS TS1 AND TS2 RATHER THAN RESTATING THEM: the front door takes its own listener from ts_handoff_nodrop, which is what makes the one component that must never restart itself replaceable, and it drains on TERM. Bite-proven -- deleting the warm-up guard takes it 13/13 GREEN to 8/13 RED and the mutant moves live traffic onto the dead slot, failing ALL 16 client requests, which is the outage the guard exists to prevent measured in what the client saw. SCOPE OF THE PROBE STATED: it proves the candidate accepts a connection and answers bytes, which is liveness and not health; the deeper instrument is nx_http_probe_lib hp_run with its thirteen distinct exit codes and the honest upgrade is to compose it, never to grow a second probe here. REPOINT: /compare/deploy rung DL1 owns blue-green WARM SLOTS as an artifact-pipeline contract and this row does not restate it. What is owed HERE is the property that makes it safe on one box -- the front door is the ONLY thing that must never restart during a deploy and the ONLY thing that must be independent of the service being replaced. Today the front door is sites.elf, a single process that all 69 live route rows cross, and it holds an ordinary listener with no hot path and no drain. Argo and Flagger are Best but both presuppose a traffic router and at least two replicas, so the products do not transfer even though the pattern does [flagger-strategies]. Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Envoy (leads), ArgoRollouts (leads)	●	●	●	◉	◉
Mirror to a shadow port and discard the response DARK — `runtime/_hdl_build/nx_proxy_route.nx` EXISTS but does not declare `ts_mirror_shadow`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The zero-blast-radius canary and the cheapest real one: Flagger copies each incoming request to primary and canary, returns the PRIMARY response to the user and DISCARDS the canary response [flagger-strategies]. On a single box this is a shadow port and a diff and it needs no traffic router and no second replica at all, which is exactly why it transfers when weighted shifting does not. It also composes with the capability-loss oracle above -- a mirrored request answered differently by the candidate is the strongest available evidence before anyone depends on it. dossierwatching ts_mirror_shadow Pros none measured yetCons behind Envoy (leads), ArgoRollouts (leads); open contract; expected source declaration not established	○	○	○	◉	◉
Bake with a minimum request denominator before promoting DARK — `runtime/_hdl_build/nx_mgmt_api.nx` EXISTS but does not declare `ts_bake_window`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Amazon's pipelines hold a stage for a bake window and wait for a specific number of data points, for example at least 100 requests to a named API, before advancing, precisely because a negative impact is often slow-burning and not readily apparent [aws-handsoff-deploy]. A rollback check that passes on zero requests is the gate-passes-on-the-empty-set defect wearing a deploy costume. Argo's third state is the honest one and is the shape to copy: an inconclusive analysis PAUSES at the current step rather than being folded into pass or fail [argo-rollouts-analysis]. dossierwatching ts_bake_window Pros none measured yetCons behind ArgoRollouts (leads); open contract; expected source declaration not established	○	○	○	○	◉
Tell the peer which requests were processed before closing DARK — `runtime/nx_http_server.nx` EXISTS but does not declare `ts_goaway_lastid`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. RFC 9113 GOAWAY carries the last stream identifier the sender might have acted on, which is the only mechanism in the whole field that makes retry CORRECTNESS decidable rather than guessed, and it prescribes two frames with at least a round-trip between them so a connection can be cleanly shut down without losing requests; a connection that terminates WITHOUT a GOAWAY forces the client to treat the last stream identifier as the highest possible, so nothing non-idempotent can be safely retried [rfc9113-goaway]. HONEST SCOPE STATED RATHER THAN PROMISED: the guarantee exists only on HTTP/2 and above and our edge serves HTTP/1.1, which has Connection close and no last-processed marker, so this rung is bounded by the protocol and its cost includes that. dossierwatching ts_goaway_lastid Pros none measured yetCons behind nginx, HAProxy, Envoy (leads); open contract; expected source declaration not established	○	●	●	◉	○
Wait hints derived from the real recovery bound Measured: `ts_retry_after_derived` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. RFC 9110 defines Retry-After as an HTTP-date or a number of seconds with NO range, NO jitter and no accuracy obligation, so a scalar synchronises the herd by construction and a wrong value is fully spec-compliant [rfc9110-retry-after]. OUR MEASURED INSTANCE: an advertised retry-after of 30 seconds against a real 300-second lock TTL, so an honest caller obeying the advice hammered a lock that could not possibly be free, and a census found four sibling lanes with the same mismatch, three of them twenty times short. THE CORRECTION IS THE QUESTION AND NOT THE NUMBER -- a 300-second exclusive lock is not a retry situation at all, so the right answer is a non-retryable error class, and any hint that is emitted must be derived from the same named constant as the lock rather than typed a second time. Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
The undo path is proven not to traverse the subject DARK — `runtime/_hdl_build/nx_mgmt_api.nx` EXISTS but does not declare `ts_undo_independence`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. THE CENTRAL AXIS OF THIS DOMAIN, and the field's position is doctrine everywhere and a tested property NOWHERE. AWS states it four ways -- the data plane keeps working under control-plane impairment, recovery takes no deliberate control-plane dependency [aws-static-stability], use data-plane API operations with pre-stored credentials for recovery, and monitor from somewhere that does not share fate [arc-dataplane-recovery] -- and then its own post-event summary concedes that the situation had no established operational recovery procedure [aws-us-east-1-2025-pes]. MEASURED FOR US FROM THE LIVE ROUTE TABLE RATHER THAN ASSERTED: /api resolves to the mgmt daemon and /api/tools and /mcp to the tools API, and BOTH are reached through the single sites.elf front door, so the process whose restart is the incident sits on the path to the call that undoes it -- with an 8-minute estate-wide blackout already on record. THE CHEAPEST FIX IS NOT A SECOND CHANNEL, IT IS A PROCESS YOU DID NOT KILL: nginx rolls back by signalling a master that never stopped running, touching no build and no promote [nginx-binary-upgrade], while ours re-promotes a banked binary and therefore needs the build path alive at exactly the moment it may not be. A gate that resolves the dependency chain of the rollback ACTION and REFUSES when it passes through the thing being rolled back is the enforcement the field only writes essays about, and it is the second exceed this domain can earn. dossierwatching ts_undo_independence Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Automated rollback triggered on capability loss DARK — `runtime/_hdl_build/nx_mgmt_api.nx` EXISTS but does not declare `ts_rollback_on_caploss`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The oracle exists and the TRIGGER does not: rg_missing and rd_in_baseline already answer whether the new build still does everything the old one did, and nothing fires a rollback from them. Argo is Best at the mechanism, with analysis results driving the state machine and a failed analysis setting the canary weight back to zero [argo-rollouts-analysis]. THE COUNTERWEIGHT IS PART OF THE CONTRACT AND NOT A CAVEAT: in the October 2025 us-east-1 event health checks alternating between failing and healthy drove automatic failover that took HEALTHY capacity out of service, the alternation increased load on the health-check subsystem until it degraded, and the mitigation that worked was DISABLING the automation [aws-us-east-1-2025-pes]. So this rung ships only with all four of a two-window burn-rate signal whose short window stops the action latching after recovery [sre-slo-burn-alerts], a bounded number of automatic actions per unit time, a minimum-request denominator, and a time-boxed off switch that AUTO-RE-ARMS -- the last of which no progressive-delivery controller ships. dossierwatching ts_rollback_on_caploss Pros none measured yetCons behind ArgoRollouts (leads); open contract; expected source declaration not established	○	○	○	○	◉
No retry advice when the outcome is unknown Measured: `er_read_after_accept` exists in `runtime/nx_edge_refusal_lib.nx`, verified at emit. LANDED 2026-09-04 AND WITNESSED LIVE FROM THE SERVING FRONT DOOR DURING THIS AUDIT RATHER THAN FROM A LOG: an unsafe request through sites.elf came back status 503, title Outcome Unknown, stage read-after-accept, retry unsafe, with NO Retry-After at all -- the shipped behaviour answering for itself. THE DEFECT IT ENCODES, MEASURED 2026-09-03: sd2_proxy_to returns less than zero when the backend could not be CONNECTED to and exactly zero when the backend ACCEPTED the request and then sent nothing inside the edge window, and for an unsafe method that second case is not an unavailability at all -- the request was taken, so the write may already have committed and the outcome is UNKNOWN. The edge nonetheless answered Service Unavailable with Retry-After, which is advice to perform the one action this estate has measured as corrupting, because an insert edit is not idempotent and a blind retry double-applies; FOUR specimens in one session had ALREADY LANDED. RFC 9110 is why the old answer was fully spec-compliant and still wrong: Retry-After is a bare scalar with no range, no jitter and no accuracy obligation, and nothing in it obliges the sender to be right about whether replay is safe [rfc9110-retry-after]. THE EXTRACTION IS THE POINT AND IT CAME SECOND: the fix shipped 2026-09-03 as three lines inline in the daemon request loop, which made it correct and UNTESTABLE at the same time because a gate cannot import a top-level programme, so the decision was moved into ONE ruler with two consumers -- the daemon that emits the refusal and the gate that proves it -- and the two cannot disagree about what an unsafe method is. VERIFIED, NOT ASSERTED: er_read_after_accept resolves 7 times across buildroot/runtime at coverage_complete=1 and corpus_complete=1, declared once at nx_edge_refusal_lib.nx line 39 and consumed by the front door at nx_sites_daemon_v2.nx line 1766, the other five being the gate's own call sites; live sites.elf reads 564912 bytes. nx_edge_refusal_gate is 15 of 15 GREEN with EIGHT named negative controls, and the load-bearing one is the cross product: a SAFE method on the very same accepted-then-silent stage must still get its retryable 503, which is the tooth that catches a guard suppressing the advice for everything -- the guard-that-refuses-everything failure this estate has already paid for. Two fixture-reached-the-condition teeth pin the first bytes so an empty buffer cannot pass every comparison against zero. SCOPE DECLARED RATHER THAN GLOSSED: these teeth prove the DECISION and not the WIRING, and the discriminator is the request line's first byte, so CONNECT is deliberately NOT claimed because a proxy CONNECT never reaches this path and naming a case the code cannot see would be a false assurance. THE FOUR RIVAL CELLS READ 0 ON THE AXIS AS LABELLED, and what the proxies actually hold is the ADJACENT axis: method-aware INTERNAL retry, with Envoy's retry budget expressed as a percentage of live traffic so retry load scales with success rather than with failure [envoy-retry-budget]. That governs whether the PROXY retries; it never governs whether the refusal handed back to the client advises the client to. ArgoRollouts is not an edge and has no request-level refusal at all. The sibling row above records the field's ONLY mechanism that makes retry correctness decidable rather than guessed, and it is an HTTP/2 GOAWAY frame that our HTTP/1.1 edge does not have [rfc9113-goaway]. This row is the conservative half of that same question answered at the refusal instead: we cannot tell you what landed, so we will not tell you to try again. Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of nginx, HAProxy, Envoy, ArgoRollouts; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Status analytics and the non-empty-200 SLA gauge Measured: `nx_statuscensus` exists in `runtime/nx_statuscensus.nx`, verified at emit. OPERATOR 2026-09-05: analytics on every response status the estate returns -- 200, 404, 503, every other code, and UNDEFINED, the request that got NO status at all -- and a gauge that holds the front door to 99 percent and above 200s WITH a confirmed non-empty expected body. Rung TS11 pre-declares the done-rule: one edge-written row per response sent (synthesized ones included) to a truncate-rotated status journal, a per-route status partition that SUMS with UNDEFINED as its own bucket, an SLA permil of 200-and-delivered over all rows that is RED below 990 and names every offending route, and a minimum-row denominator that reports UNOBSERVED rather than passing. THE CLASS THAT MOTIVATED IT IS MEASURED, NOT FEARED: on 2026-09-05 the front door answered 503 Outcome-Unknown to seven unsafe calls whose writes had LANDED (debt 1788630978, sev 9) -- a 503 that is really a 200 with a dropped receipt is exactly the row this census must count as UNDEFINED, never as a failure and never as a success. nginx and HAProxy carry access logs and stats pages (Yes); Envoy carries per-route stats plus structured access logging with response flags that name WHY a request failed (Best); Argo Rollouts consumes metrics for its analysis and carries none of its own (Part). None of the four measures delivered-body-vs-empty, which is the half this rung adds. Extends the actlog nx_tools_api already writes; a second request journal beside it is refused by construction. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Envoy (leads)	●	●	●	◉	●

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	17	rows carrying a Yes, Best or Part in a rival column
cited	11	a reference mark resolves to a pinned mirror
uncited	6	an observation read, badged until a reference lands
rows, summed	17	RECONCILED: the parts sum to the total 17

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
Two overlapping listeners are exactly what the duplicate-port detector is built to flag, so TS1 makes a working guard fire on correct behaviour	likely x medium	TS1 must teach nx_portdup to tell a bounded handoff overlap from a squat in the SAME change that creates the overlap -- never by widening the detector to ignore the port, and never by shipping the overlap first and fixing the alarm later.
Automated rollback on a measured signal is the mechanism that caused the outage this domain cites, so TS6 can make things worse rather than better	possible x high	TS6 does not ship without all four safeties as separate teeth, and its gate must include a flapping-input fixture that FAILS the rung if the action rate is unbounded. If any of the four cannot be proven, the rung ships in report-only mode.
A drain deadline is a number somebody picks, which is the magic-number defect this estate refuses	likely x medium	TS2's deadline is derived from the measured distribution of in-flight request durations already observable on the serving path, published with its sample size, and refuses to arm below a declared minimum number of samples -- the same arming protocol the load-ceiling rung uses next door in loadgov.
The front door becomes a new single point of failure that is now also load-bearing for deploys	possible x high	TS3's front door does the smallest possible job -- choose an upstream -- and TS1 must land first so the front door itself is replaceable without a gap; a front door that cannot be replaced hitlessly is refused rather than deployed.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-05	TS10	land	SEV-9 (debt 1788630978, operator 2026-09-05 'address it so we dont have unclear deploys'): THE FRONT DOOR DROPPED THE RECEIPT OF UNSAFE CALLS UNDER A STORM. Mechanism read from nx_tools_api.nx: the ASYNC JOB LANE reserved the job id, wrote the claim and forked the runner, then sys_wait4()ed the middle child and appended the fsync'd actlog row BEFORE building its JOB-STARTED reply -- on a storming array that bookkeeping outlived the 15000 ms edge window, sites.elf synthesised 503 Outcome-Unknown, and the reserved id (the only handle to the outcome) was never delivered while the job ran anyway. The PROMOTE lane had this exact fix since debt 1787505278 (announce the id first, park the bookkeeping, drain after the reply is on the wire); the sibling lane did not -- half a law, and the half every seat's writes ride. Measured today: 7 dropped receipts, 6 had landed; one self-anchored insert issued twice ended at ONE copy by luck. SOURCE FIX LANDED: nx_tools_api.nx +ta_ap_* statics, ta_async_pending(), ta_async_finish() (reap + actlog), the async lane REPLIES FIRST under ta_defer_ok and parks pid1/name/jid/t0 (pure-bytes gate callers keep the inline order byte-for-byte); nx_tools_api_serve.nx calls ta_async_finish() right after ta_promote_finish(). BUILT nx_tools_api_serve 263222 B sha 991b2522 (staged nx_tools_api_serve.sov.elf.new, src_stable=1). NOT DEPLOYED: this is the transport every seat rides and an 8-minute blackout is on record for this daemon's startup path -> health-checked /api/deploy on a CALM box with the live binary banked by hash and an operator go. OPEN halves of the same row: a caller nonce (_nonce=) matched durably beside the job id so a same-nonce re-issue returns the ORIGINAL outcome (this rung's retry-safety announcement in its HTTP/1.1 form), and the edge carrying the reserved id inside its 503 body. Companion defect: /api/build's cache served a STALE artifact with an unchanged output sha across a changed src three times today (debt 1788629238) -- a BUILT receipt can name a binary that is not the source; verify staged bytes by content, nx_sov_build_run's cache key was honest each time.
2026-09-05	TS11	land	nx_statuscensus source LANDED in buildroot/runtime: nx_statuscensus_lib.nx (16859 B, the ONE classifier -- edge sites_telemetry.log tail window into the partition DELIVERED / EMPTY / 404 / SYNTH-5xx / UNDEFINED (rc<0, no HTTP status) plus a separate proxied-unstatused axis for vh=70 rows whose backend status the edge never journals; actlog.jrnl into DELIVERED / EMPTY / ERROR / RECEIPT; SLA permil = delivered over ALL rows so an empty 200 is not a delivery; a window under min_rows is UNOBSERVED and never votes; level truncate-written to knowledge/status/statuscensus.status with verdict= as the LAST line, trajectory appended to knowledge/status/statuscensus.log), nx_statuscensus.nx (1687 B program, bars from knowledge/statuscensus.conf, defaults announced src=default), nx_statuscensus_gate.nx (10935 B: four in-process fixture runs RED / GREEN-with-absent-journal / UNOBSERVED / tail-window, three neg-controls, every number asserted and emitted via gv_check_eq). Builds QUEUED by admission under the I/O storm (BQ-nx_statuscensus_gate, BQ-nx_statuscensus). Next: gate GREEN on the NAS, promote + register + nx_offc_install, a clock row running the census, the first live status row, then the watch flips and the emitter renders it. Owed after that: a st=<code> field on nx_telemetry_emit so proxied replies stop reading as delivered-by-bytes.
2026-09-05	TS11	measure	nx_statuscensus_gate BUILT on the sov lane (51784 B, daa41c9d), PROMOTED, REGISTERED, first run on the NAS = 35/35 GREEN: fixture A every bucket by value (edge 10 rows -> delivered 6 / empty 1 / 404 1 / synth-5xx 1 / UNDEFINED 1, partition sums, proxied-unstatused 1 on its own axis, sla 600 permil; tools 7 rows -> delivered 4 / empty 1 / error 1 / receipt 1, sla 571), B GREEN with the tools journal ABSENT (that axis reads UNOBSERVED with permil -1, never zero rows), C UNOBSERVED under min_rows (rc 3, no vote), D a tail window five bytes short skips the cut first row and announces its byte count; neg-controls: a synthesized 503 with a body is not delivered, rc<0 with a body and vh=71 is UNDEFINED not synth, an error exit with a body is an error. Next: promote the program (staged 5c0eded2), register, first live status row, clock beat.
2026-09-05	TS11	measure	FIRST LIVE STATUS CENSUS (nx_statuscensus PROMOTED 5c0eded2, REGISTERED, run 1788635835, window 8 MiB = the last ~day, bars from knowledge/statuscensus.conf src=conf): EDGE 165947 connections -> delivered 118879 (716 permil) / empty 2874 / 404 11175 / synth-5xx 1269 / UNDEFINED 31750 (TLS handshakes that never reached HTTP), partition sums; proxied-unstatused 78037 on its own axis = the size of the blind spot until nx_telemetry_emit carries st=<code>; edge SLA 716 permil against the 990 bar = RED. TOOLS API 76934 calls -> delivered 46245 (601 permil) / empty 4 / error 15112 / async receipts 15573 (counted as NOT confirmed delivery until their _jobs artifact is joined -- TS12 owed), act SLA 601 permil = RED. verdict=RED, level written to knowledge/status/statuscensus.status (verdict last line), trajectory row appended to knowledge/status/statuscensus.log. Clock row statuscensus every 3600 s declared (nx_clockjob put; folds into the live plane at the scheduler's next window-init). The watch row on this board flips on the next regen. Worklist the numbers name, largest first: (1) st= on the edge emitter so 78037 proxied rows stop reading as delivered-by-bytes; (2) the UNDEFINED class -- classify handshake failures (scanner, aborted, TLS version) before treating them as SLA misses; (3) 404s at 67 permil of connections -- a top-paths census; (4) the 1269 synthesized 5xx are the sev-9 front-door drops (debt 1788630978, fix built, deploy owed); (5) tools-API errors 15112 -- an exit-code census by tool.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. Honest position. We are ahead of the field on proving that a change did not silently delete a capability, and materially behind it on everything that keeps traffic alive while the change lands. The strong side is measured and it is real. Every automated rollback in the field fires on availability proxies -- error rate, latency, crash rate, CPU. Google's own canary service says the limit out loud: it asks whether the canary is meaningfully worse and is not trying to establish absolute health, and its lessons section concedes that good health metrics are surprisingly rare [cas-canary-analysis]. A build that answers 200 to everything while having silently stopped serving a route is invisible to all four columns. We hold two rulers that see exactly that -- <code>rg_missing</code> names every route the live binary serves and the candidate does not, and <code>rd_in_baseline</code> catches any route vanishing across a deploy -- and both were built after the regression happened to us, five measured times. The weak side is not a gap we can wave away, and the operator's instinct was right. We replace the single serving process every caller uses, with no drain, no overlap on the front door, no traffic shifting and no automated rollback. Three numbers say it precisely, each full-population with declared coverage. First: <code>nx_http_server_listen_hot</code> resolves 9 times across the whole tree and exactly 2 are production call sites -- nx_mgmt_api and nx_tools_api_serve -- so the sites.elf front door that all 69 live route rows cross holds an ordinary listener and cannot hand off at all. Second: <code>rt_sigaction</code> resolves 8 times and every one is SIGPIPE handling, a crash handler, or the nx_signal library itself -- zero were a TERM drain in a serving daemon when this page was admitted, and that is now ONE -- <code>nx_survey_daemon</code> arms <code>ts_drain_on_term</code> before its listener exists. And the census pointed at a file that could never have carried it: <code>rt_sigaction</code> is spelled RV64 134 in <code>nx_signal.nx</code>, 134 is not a key in <code>x86ctx_rv64_to_x86_64_syscall</code>, and that table's default branch is a pass-through -- so on the live x86 target <code>nx_signal_action_install</code> lands on <code>uselib</code> and installs nothing. The 8 references were never the adoption gap they looked like; the shipped drain therefore installs no handler at all, blocking TERM and consuming it as a pollable descriptor, which also removes the EINTR mid-response truncation a handler would have introduced, and Kubernetes names the precise consequence: endpoint removal happens at the same time as shutdown begins, so a process that exits on TERM is what produces the client-visible 5xx [k8s-pod-termination]. Third: <code>sys_sendmsg</code> was ABSENT-PROVEN from all of buildroot/runtime at coverage_complete=1 and corpus_complete=1, so the mechanism the field actually uses -- passing the listening descriptor over SCM_RIGHTS [haproxy-seamless-reload] -- could not be written at all. That gap was closed on 2026-08-21 and this sentence is corrected rather than left standing: the shim now carries <code>sendmsg</code>, <code>recvmsg</code> and <code>sys_send_fd</code>/<code>sys_recv_fd</code>, and <code>ts_handoff_nodrop</code> in <code>nx_http_server</code> is proven against the pre-declared accept rule in DROPPED CONNECTIONS: the handoff arm drove 17 connections across a real process swap for zero drops with the arrival during the gap connecting cleanly, while the identical harness against today's bind-per-process path lost one and refused the in-gap arrival with ECONNREFUSED. The remaining deficit WAS adoption, and that half closed on 2026-08-21 -- this sentence is corrected rather than left standing, because a stale claim is worse than the original error. <code>nx_survey_daemon</code> is the FIRST ADOPTER: it calls <code>ts_handoff_nodrop</code> instead of binding, and the adoption is proven in DROPPED CONNECTIONS across a real fork+exec restart of the real binary, not by the source referencing a symbol -- <code>nx_survey_handoff_gate</code> 12/12, ADOPTED arm attempted=17 served=17 drops=0 with the in-gap arrival connecting cleanly, NEG-CONTROL the same binary with no owner attempted=17 served=16 drops=1 and the in-gap arrival refused ECONNREFUSED. The subject was chosen from the route table rather than from taste: it carries exactly ONE of the 69 live rows, owns its binary outright, and fronts no control-plane path -- deliberately NOT sites.elf, which is rung TS3. Envoy's ordering rule went in with it: its three arenas and its seg-store warm now run BEFORE the socket is acquired, so the publish returning is itself evidence that initialisation completed while the outgoing generation was still serving. What remains is one deploy decision and one owner process, not a capability gap -- and because <code>ts_handoff_nodrop</code> falls back to binding when no owner publishes, the adopted daemon is byte-for-byte safe to deploy before any owner exists. And the primitive we did adopt is the weaker one. LWN documents SO_REUSEPORT as carrying a defect: when the number of listening sockets bound to a port changes, connections can be dropped during the three-way handshake, because the final ACK may not be routed to the socket that received the SYN [so-reuseport-lwn]. So our own <code>nx_hotlisten_gate</code> proves the necessary condition -- two processes can hold the port -- and never the sufficient one, zero drops. The estate had already written the right accept rule and never met it: <code>nx_pm_sclass_deploy</code> carries A3 FD-passing zero-downtime hot-swap GATE=0-dropped-conns-across-swap status=ASSIGNED. The central axis is the undo path. Static stability is doctrine stated four ways by one organisation -- the data plane keeps working under control-plane impairment, recovery takes no deliberate control-plane dependency, use data-plane operations with pre-stored credentials, monitor from somewhere that does not share fate [aws-static-stability] [arc-dataplane-recovery] -- and it is a tested property nowhere; AWS's own post-event summary concedes the situation had no established operational recovery procedure [aws-us-east-1-2025-pes]. Read from our live route table, <code>/api</code> resolves to the mgmt daemon and <code>/api/tools</code> and <code>/mcp</code> to the tools API, and both are reached through the one sites.elf front door -- so the process whose restart is the incident sits on the path to the call that undoes it, and an 8-minute estate-wide blackout is already on record. The cheapest fix is not a second channel, it is a process you did not kill: nginx rolls back by signalling a master that never stopped running, touching no build and no promote [nginx-binary-upgrade], while ours re-promotes a banked binary and therefore needs the build path alive exactly when it may not be. And the counterweight is not optional. Automated rollback on a measured signal caused the October 2025 outage: health checks alternating between failing and healthy drove automatic failover that took healthy capacity out of service, the alternation degraded the health subsystem itself, and the mitigation that worked was disabling the automation [aws-us-east-1-2025-pes]. Anything we build here ships with a two-window burn-rate signal [sre-slo-burn-alerts], a bounded action rate, a minimum-request denominator, and a time-boxed off switch that auto-re-arms -- which no progressive-delivery controller ships. One more honest number. Of the routing and edge organs censused, 6 of 8 are REGISTERED-DARK -- callable, authorised, with no invocation on record -- and the two daemons that ARE the traffic path, nx_hub_gw and nx_daemon_supervisor, are PROMOTED-UNREGISTERED, real binaries nobody can call. The safety tooling is not missing. It is dark.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/trafficsafety.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain trafficsafety, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from trafficsafety.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	3
scanned	3
fetched	2
reused	1
failed	0
named	3
candidates	3
mentions	3
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	nginx	1	1	col0-nginx	named	https://web.archive.org/web/2024/https://nginx.org/en/docs/control.html
2	HAProxy	1	1	col1-haproxy	named	https://www.haproxy.com/blog/truly-seamless-reloads-with-haproxy-no-more-hacks
3	Envoy	1	1	col2-envoy	named	https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/hot_restart

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 25 capabilities: 24 exclusive to it and 1 shared with other boards. Shared rows on this page: 1 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 1 + refused 0 (partition 1); undecided = unmapped 0 + unproven 1 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6760.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
sni_backend	`nx_sni_route.nx`	authz, deploy, trafficsafety	—	none	unproven	undecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395865 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[so-reuseport-lwn] Kerrisk, M. The SO_REUSEPORT socket option. LWN.net, March 2013. publisher · read in our library knowledge/fetched/cmp_trafficsafety_so-reuseport-lwn.html · pin h1b28cf47fc0cc10ee274942642444e32837f6aa0d1fbc4f647f2b23a69b997ae · accessed 2026-08-21 · mirrored-indexGrounds: Hot listener a second process can hold the port while the old still serves -- the mirror carries verbatim that a change in the number of listening sockets can drop connections during the three-way handshake, and calls it a defect in the implementation
[haproxy-seamless-reload] HAProxy Technologies. Truly Seamless Reloads With HAProxy -- No More Hacks. HAProxy blog. publisher · read in our library knowledge/fetched/cmp_trafficsafety_haproxy-seamless-reload.html · pin h81249aec4560ba23430c269a25932729fd83596b618ee9edd726db8171c5881f · accessed 2026-08-21 · vendor-docGrounds: Zero dropped connections across a process swap -- descriptor transfer over SCM_RIGHTS and the measured 155 connection failures per million before the fix
[nginx-binary-upgrade] nginx documentation. Controlling nginx -- master and worker signals and upgrading the executable on the fly. Archive snapshot read 2026-08-21 because nginx.org fails our TLS client. publisher · read in our library knowledge/fetched/cmp_trafficsafety_nginx-binary-upgrade.html · pin h2dc954fc22c9607d7201f13eca031d2b3be6c77d92ec880fc879021d1ea4150d · accessed 2026-08-21 · vendor-docGrounds: The undo path is proven not to traverse the subject -- rollback is a HUP to a master process that never stopped running, touching no build and no promote
[envoy-hot-restart] Envoy Proxy architecture overview. Hot restart -- process handoff order, socket copying, drain and parent-shutdown timers. publisher · read in our library knowledge/fetched/cmp_trafficsafety_envoy-hot-restart.html · pin h41536cc52e01428d8a783ccd090c743ecfd6b3a8e60497f1705d3e03a0334e39 · accessed 2026-08-21 · vendor-docGrounds: Hot listener a second process can hold the port while the old still serves -- the new process fully initializes itself BEFORE it asks for copies of the listen sockets, and existing connections are never transferred
[envoy-draining] Envoy Proxy architecture overview. Draining -- drain triggers, graceful versus immediate, per-filter drain support. publisher · read in our library knowledge/fetched/cmp_trafficsafety_envoy-draining.html · pin h78ca35517a7323f3754b497b7330b84198abd17cf0a2ed64f9bdf1f242407931 · accessed 2026-08-21 · vendor-docGrounds: Cooperative drain keep serving after TERM until a named deadline -- graceful draining is implemented for only four filter types and a plain TCP proxy hard-closes
[envoy-outlier-detection] Envoy Proxy architecture overview. Outlier detection -- passive health checking, ejection algorithms and the max ejection cap. publisher · read in our library knowledge/fetched/cmp_trafficsafety_envoy-outlier-detection.html · pin h818560700088c8dbb774be2b9f047d6624e57cb0fc273b6469265c7fa6a6dd09 · accessed 2026-08-21 · vendor-docGrounds: Request-path admission and shedding -- max_ejection_percent is the bounded-remedy pattern so a global fault cannot make the detector eject the whole fleet
[envoy-retry-budget] Envoy v3 API. CircuitBreakers Thresholds RetryBudget -- budget_percent, min_retry_concurrency, budget_interval. publisher · read in our library knowledge/fetched/cmp_trafficsafety_envoy-retry-budget.html · pin haa7f1e4da0995d4b385f897ca740dc7336bd33520ed659ae8ba691d47c656245 · accessed 2026-08-21 · vendor-docGrounds: Request-path admission and shedding -- retries capped as a percentage of live traffic so retry load scales with success rather than with failure
[systemd-socket-activation] systemd.socket manual page section 5. man7.org mirror of the systemd manual. publisher · read in our library knowledge/fetched/cmp_trafficsafety_systemd-socket-activation.html · pin h2a5afec02e7666f911244e888dd1700b45e0d2c36259054b9292b144e21bff1f · accessed 2026-08-21 · vendor-docGrounds: Zero dropped connections across a process swap -- the init system owns the listener and passes the descriptor in, and FlushPending=no keeps queued connections across a restart
[k8s-pod-termination] Kubernetes documentation. Pod Lifecycle, Termination of Pods. Read from the website repository source so the ordering is exact. publisher · read in our library knowledge/fetched/cmp_trafficsafety_k8s-pod-termination.md · pin ha22f3a96a41e7613e61beb292fc28fa45b9f68e8f65e493e3e940ed1d35a8b51 · accessed 2026-08-21 · source-readGrounds: Cooperative drain keep serving after TERM until a named deadline -- endpoint removal happens AT THE SAME TIME AS shutdown begins, not before it, so the process must keep serving after TERM
[k8s-probes] Kubernetes documentation. Liveness, Readiness and Startup Probes -- what each probe does on failure and the cascading-failure caution. publisher · read in our library knowledge/fetched/cmp_trafficsafety_k8s-probes.html · pin h660aef4213b8ae9ce154791c70ed7798885d83ad7b473f183b6660bcf1a75ab1 · accessed 2026-09-05 · vendor-docGrounds: Signed daemon registry with health-probed respawn -- the startup probe exists so a slow start is not read as death, and incorrect liveness probes are named as a cause of cascading failures
[alb-deregistration-delay] AWS Application Load Balancer target group attributes -- deregistration delay and slow start mode. publisher · read in our library knowledge/fetched/cmp_trafficsafety_alb-deregistration-delay.html · pin h642a59d4e4aea00df7e981abbcb082436b4fe3c9d6d8cfa0f8fb3e0d6dff3c0e · accessed 2026-08-21 · vendor-docGrounds: Cooperative drain keep serving after TERM until a named deadline -- a target that terminates the connection before the deregistration delay elapses makes the client receive a 500-level error
[argo-rollouts-analysis] Argo Rollouts documentation. Analysis and Progressive Delivery. publisher · read in our library knowledge/fetched/cmp_trafficsafety_argo-rollouts-analysis.html · pin h67194959b0d3f3b1d7adf4deec2c1acbc05017d4f90b46d81906d30dd54f378d · accessed 2026-08-21 · vendor-docGrounds: Bake with a minimum request denominator before promoting -- an inconclusive analysis PAUSES at the current step rather than being folded into pass or fail
[flagger-strategies] Flagger deployment strategies documentation. fluxcd/flagger repository main branch. publisher · read in our library knowledge/fetched/cmp_trafficsafety_flagger-strategies.html · pin h031da19b164ef1b2bed28a8007127c14047703fce103087c8e4084767c1ce015 · accessed 2026-08-21 · source-readGrounds: Mirror to a shadow port and discard the response -- traffic mirroring sends the primary response to the user and DISCARDS the canary response, the zero-blast-radius canary
[cas-canary-analysis] Davidovic with Beyer. Canary Analysis Service. ACM Queue volume 16 issue 1, 2018. publisher · read in our library knowledge/fetched/cmp_trafficsafety_cas-canary-analysis.html · pin hb8e278e9ce33aad8e03e7c6962a23cec4d6d8c218330858e1a64c78e839452fe · accessed 2026-08-21 · published-paperGrounds: Promote refused when the candidate serves fewer routes than live -- CAS asks whether the canary is meaningfully worse and states outright that it is NOT trying to establish absolute health
[aws-static-stability] Becker and MacCarthaigh. Static stability using Availability Zones. Amazon Builders Library. publisher · read in our library knowledge/fetched/cmp_trafficsafety_aws-static-stability.html · pin h8ed40f771c551b12e7abb8594753e9dbbbfa0cdcb5a39d5e9a23798f04a3d2d0 · accessed 2026-08-21 · vendor-docGrounds: The undo path is proven not to traverse the subject -- the data plane keeps working under control-plane impairment and recovery takes no deliberate control-plane dependency
[arc-dataplane-recovery] AWS Application Recovery Controller. Best practices for zonal shifts. publisher · read in our library knowledge/fetched/cmp_trafficsafety_arc-dataplane-recovery.html · pin h46a501e69d86d83f100d4542c608ce03d375c10784e1fbee5647d8e5bceab15c · accessed 2026-09-05 · vendor-docGrounds: Reachability measured from a second vantage that does not share fate -- monitor from a second adjacent Region so application and monitoring are not impaired by the same event, and use data plane operations with pre-stored credentials for recovery
[aws-us-east-1-2025-pes] Summary of the Amazon DynamoDB service disruption in the Northern Virginia US-EAST-1 Region. AWS post-event summary, October 2025. publisher · read in our library knowledge/fetched/cmp_trafficsafety_aws-us-east-1-2025-pes.html · pin hf1c181cf8f5bf0b82ba3d55d2f222ea341bb94f573fee9759674db3f701b2a40 · accessed 2026-08-21 · vendor-docGrounds: Automated rollback triggered on capability loss -- the COUNTERWEIGHT: flapping health checks drove automatic failover that removed healthy capacity, and the mitigation that worked was disabling the automation
[aws-handsoff-deploy] Liguori. Automating safe hands-off deployments. Amazon Builders Library. Archive snapshot read 2026-08-21 because the canonical URL redirects to a shell page. publisher · read in our library knowledge/fetched/cmp_trafficsafety_aws-handsoff-deploy.html · pin he2fbb62ed6af7f3259fed432780abb4608da1a1701b5d3df317bd4325684a862 · accessed 2026-08-21 · vendor-docGrounds: Bake with a minimum request denominator before promoting -- bake time waits for a specific number of data points, for example at least 100 requests, and a one-box stage carries its own scoped rollback alarm
[sre-slo-burn-alerts] Google Site Reliability Workbook chapter 5. Alerting on SLOs. publisher · read in our library knowledge/fetched/cmp_trafficsafety_sre-slo-burn-alerts.html · pin h5a2195ae9280d92489ec6c5be9781ef191d73137514da7c716ebabf5479cfcf5 · accessed 2026-08-21 · published-courseGrounds: Automated rollback triggered on capability loss -- the signal shape is a two-window burn rate where the short window exists so the action does not latch after recovery
[rfc9113-goaway] Thomson and Benfield. HTTP/2. IETF RFC 9113, section 6.8 GOAWAY. publisher · read in our library knowledge/fetched/cmp_trafficsafety_rfc9113-goaway.txt · pin ha00ef91b64e111a282e77ec66980f5242e77c0bb5e33e0927e3b6757080506de · accessed 2026-08-21 · published-standardGrounds: Tell the peer which requests were processed before closing -- the last stream identifier makes retry correctness decidable, and a connection closed without GOAWAY forces the client to assume everything may have been processed
[rfc9110-retry-after] Fielding, Nottingham and Reschke. HTTP Semantics. IETF RFC 9110, section 10.2.3 Retry-After. publisher · read in our library knowledge/fetched/cmp_trafficsafety_rfc9110-retry-after.txt · pin h21c1cdce6ab0e5509b04d84a28000836c7a087cf786efe6f04877ebfff47232a · accessed 2026-08-21 · published-standardGrounds: Wait hints derived from the real recovery bound -- Retry-After is a bare scalar with no range and no jitter and the spec imposes no accuracy obligation

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/trafficsafety.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls