nx_domain_admit_gate.nx

nx_domain_admit_gate.nx -- THE GATE FOR THE ADMISSION GATE. THE ABSENCE THIS CLOSES, quoted from the ship loop on 2026-08-25: "PROVE NO-GATE-FOUND -- a NAMED absence, NOT a pass: NOTHING about this target has been proven." nx_domain_admit decides whether every /compare domain may publish. It shipped TWO changes that day -- C3 (resolve <domain>.gates in BOTH trees) and C4 (fresh-kill read from the bite records) -- with no proof of its own. The organ that refuses on everyone else's behalf was the one thing nothing refused. WHAT IS UNDER TEST is the PURE decision core in nx_domain_admit_lib.nx, driven IN-PROCESS. This gate deliberately does NOT fork an admission run: forking the deployed elf would make every mutant come back NOT-REACHED, so the resulting GREEN would read exactly like a proof while proving nothing, and it would also measure whatever the live /compare tree happened to contain this minute rather than the code. Fixtures are built IN MEMORY where possible and under /tmp/nx_domain_admit_gate/ where a real file is genuinely required -- never under knowledge/store, because a gate that shares a fixture with a production beat measures the beat and not the code. THE ONE THING MEASURED AGAINST LIVE DATA is the C3 regression, and it is guarded by a PRECONDITION rather than asserted: if knowledge/compare/lang.gates ever moves, this gate SKIPs with the missing precondition named. A domain changing under the gate must never be able to turn it RED. ANTI-VACUITY, stated up front because "the classifier agrees with itself" is trivially true: - da_wfind is proven to REFUSE a prefix, a suffix and an inner substring, and to skip a prefix hit and find the real standalone occurrence later in the same buffer. A plain substring matcher passes every other wfind tooth on this gate and fails that one. - da_classify_row is proven to return FOUR DISTINCT values, so a constant classifier cannot pass. - da_c4_partition is proven to reach all three buckets AND to report nothing on the empty map. - every refusal is a gv_bite: it must fire on the crafted bad input and stay silent on the good one. 100 percent sovereign. No hardware writes (Rule 26). license_tier: ORIGINAL expect_exit: 0