nx_charjudge_frame_gate.nx

nx_charjudge_frame_gate.nx -- THE REFEREE FOR GR38 cjc_frame_guard: the judge grades or abstains, never dies. GR38's done-rule, quoted from graphics.plan so the bar cannot drift: "the judge grades a full-resolution frame or ABSTAINS by name and never dies, a debug build exists so the next crash is locatable, and the abstention is a THIRD state that can neither acquit nor convict" WHAT THIS GATE IS DEFENDING. The reproduced trigger is that argv is NULL-TERMINATED, so a call with no LABEL makes argv[2] the terminator and printing it dereferences 0x0 -- exit 139 = 128+11 before the guard, answered as {"abstain":"NO-LABEL-ARGUMENT"} rc=4 after it. * A CRASH ATTRIBUTED TO THE DATA WHEN IT BELONGS TO THE CALL SENDS EVERY READER INTO THE WRONG ORGAN. SCOPE DECLARED: the board also recorded the crash as happening ON THE BEACH CAPTURE, implying frame size was the trigger. That half is UNPROVEN either way here -- it was measured only against a laptop tree whose nx_charjudge_lib is ~14 KB behind the shipping one, and a cross-tree control is not a control. The guard is a PURE function taking pointer values as integers, so every refusal path is reachable here without manufacturing a corrupt PNG -- a gate that could only test the paths a real file can produce would leave the null-pointer branches, which are the ones that crashed, permanently unexercised. license_tier: ORIGINAL No hw writes (Rule 26).