nx_atomic_publish_gate.nx

nx_atomic_publish_gate.nx -- END-TO-END gate for `nx_atomic_publish landed` (ap_landed, DM4). THE CORPUS IS THE ESTATE'S OWN RECORD. Every REAL row below reproduces an ambiguous write from 2026-08-15 to 2026-08-20 whose landed-or-not was settled BY HAND at the time, mined out of the lane memories and CLAUDE.md; the hand answer travels beside it as ground truth. Three rows are labelled CONSTRUCTED and counted separately: two are grammar guards, and one is the double-insert the CAS guard AVERTED on 2026-08-20 -- the record describes the outcome it prevented, so the artifact never existed and claiming it as observed would be a fabrication. THE BAR, pre-declared in devmgmt.plan: "emits LANDED or NOT per row matching the hand adjudication with ZERO FALSE LANDED -- wrong only toward NOT". A false LANDED is a lost edit nobody re-applies; a false NOT-LANDED costs one idempotent retry. false_landed is therefore counted as its own number and asserted at zero, separately from the overall diff. THE TWO CONTROLLED PAIRS ARE THE SHARPEST ROWS, and they come straight out of the record: the SAME 503 reply over a write that HAD landed and three that had NOT, in the same hour; the SAME bare empty-object reply over a write that had landed and one that had not. An organ that consults the transport reply gets one of each pair wrong by construction. The third discriminator is one ARTIFACT adjudicated twice: from a size-only row it must ABSTAIN, from a content-hash row it must say LANDED. An organ answering from the file rather than from the declared evidence cannot separate those two. TEETH THE TRIVIAL WRONG IMPLEMENTATIONS CANNOT PASS, all in ONE run: an always-LANDED organ loses the NOT-LANDED rows and trips the false-landed bar; an always-NOT-LANDED organ loses the LANDED rows; an always-UNKNOWN organ -- the guard that refuses everything and thereby passes every negative test -- loses both and cannot reach DECIDED-ALL. Fixtures are assembled at RUNTIME under /tmp/nx_ap_landed_gate/<epoch>/ -- never beside a production beat. Idempotent: the epoch-suffixed directory means a second run cannot inherit the first run's state. usage: nx_atomic_publish_gate [subject-elf] SUBJECT RESOLUTION, announced on every run because the answer depends on it: argv[1] if given, else the freshly BUILT candidate buildroot/_build/nx_atomic_publish.sov.elf, else the deployed twin _offc/nx_atomic_publish.elf, else the serving root, else SKIP. The build-first order is what makes this gate usable as nx_organ_ship's PROVE stage, which runs seconds after /api/build and is asking about the CANDIDATE. ★A GATE THAT DOES NOT SAY WHICH COPY IT JUDGED CAN BE READ AS A VERDICT ABOUT THE WRONG BINARY -- so the resolved path AND its byte count are printed before any tooth runs. Sovereign: imports nx_gatekit_lib + nx_gate_verdict. license_tier: ORIGINAL expect_exit: 0