nx_cloexec_gate.nx

nx_cloexec_gate.nx -- proves every listening socket this tree creates is FD_CLOEXEC, so a forked+exec'd child can never inherit it and hold the port hostage. THE OUTAGE THIS GATE EXISTS FOR (measured live 2026-07-30): `netstat -tlnp` showed BOTH 127.0.0.1:18098 LISTEN 707/nx_hostctl <- the SUPERVISOR 127.0.0.1:18098 LISTEN 24311/./nx_opaque_l <- a login daemon whose argv names ONLY port 9091 while nx_mgmt_api -- whose port 18098 is -- was NOT LISTENING AT ALL and its restart counter climbed 6 -> 7. THE CHAIN: /api/deploy forks+execs nx_hostctl from inside nx_mgmt_api, which was holding its listening socket with no FD_CLOEXEC. hostctl inherited the fd; hostctl is the long-lived supervisor, so it held mgmt's port FOREVER and re-leaked it into every child it subsequently spawned. Restarting the victim can never help -- it is an outage that SURVIVES EVERY RESTART and reads as a causeless crash-loop. SO_REUSEPORT DOES NOT RESCUE IT: the kernel permits co-binding only when EVERY socket on the port set SO_REUSEPORT, so one inherited legacy socket locks out even a REUSEPORT binder. T1 is the CONTROL: a raw socket with no fix MUST read FD_CLOEXEC CLEAR. Without it, T3/T4 could pass on a kernel that sets the bit by default and would prove nothing. T5 is the neg-control on the READER itself. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0