_bs_poison.nx

_bs_poison.nx -- R1-T1-004 / X-CLEAN-002 the "next reproducer": try to make the LATENT nxasm rc=6 uninit-read DETERMINISTIC by POISONING the child's inherited context. R1-T1-004 pinned the class as parent-ctx x output-path (uninit-read in nxasm, value=parent-residue, relevance=path-slot) but the trigger went latent (fresh /tmp, residue gone). This probe floods the nxasm child's inherited ENVIRONMENT (the parent-controlled bytes that survive execve) with several poison patterns x sizes, plus a 1MB poison scratch fill, and assembles ONE real .s to a genuinely WRITABLE output path under each config. CONTROL = clean env (must rc=0). If ANY poison config makes a WRITABLE path fail (rc!=0), the uninit-read picked up poison -> DETERMINISTIC TRIGGER FOUND (then bisect nxasm). If all stay rc=0, the defect is not reachable via this vector (strengthens latent/non-reproducible -> no-overclaim close). Pure diagnostic; NO nxasm edits. license_tier: ORIGINAL