nx_boundscheck_gate.nx

nx_boundscheck_gate.nx -- GATE for LN3 raw-pointer provenance (lang.plan rung LN3, symbol bck_ptr_provenance). The rung's done-rule: the 2026-07-08 READ-TO-NUL over-read class TRAPS under the --ptrprov declared mode, in-range programs stay accepted, the write leg (CWE-787) traps too, and a provably-out-of-range CONSTANT index is refused at compile time naming the provenance rule. Subjects: the toolchain compiler (argv[1], default the live builder) + runtime/nx_boundscheck.nx + runtime/nx_boundscheck_constidx.nx. ARTIFACT PLACEMENT follows nx_cc_equiv_gate's measured convention: .s and stderr captures in /tmp/nxbchk/ (data), but every ELF THAT MUST RUN lives under _build/ -- the NAS mounts /tmp noexec (measured 2026-08-19: 0755 binary, execve EACCES 126), so a gate that stages runnables in /tmp passes its compile teeth and fails every run tooth with no diagnostic. Names carry the gate's own pid, because two concurrent runs racing one rename source is a documented incident class in the incumbent (its line ~87). Every A/B pair runs through ONE build helper and ONE runner (no second ruler). Exit carries the verdict via gv_verdict (D001). Phase exit codes are PRINTED before the teeth -- a FAIL-only tooth cannot say why, and that blindness cost this gate's first NAS run its diagnosis (the noexec above was found by hand-running the leftover binary). Usage: nx_boundscheck_gate [compiler_elf] (CWD = the tree root, like nx_cc_equiv_gate) license_tier: ORIGINAL No hw writes (Rule 26).