nx_execsurface_gate.nx

nx_execsurface_gate.nx -- referee for nx_execsurface (2026-08-23, compare CE2). END-TO-END: forks the DEPLOYED ./nx_execsurface.elf into a /tmp/<gate>/ fixture path (never the production artifact), reads the rows back the way the shared classifier does, and checks BOTH directions of the surface rule: a program the clock demonstrably runs is credited, a program only MENTIONED is not. T1 precondition the organ did not exit 3 UNOBSERVABLE (gv_need -> SKIP, never RED) T2 exit 0 and the receipt names the artifact T3 the last line is the canonical stamp (# asof=...) with a non-zero asof T4 partition on_surface + ref_only + dark == organs (a partition is a claim) T5 full population: counted rows == organs declared, and == an INDEPENDENT count of *.elf at . and _offc/ T6 positive control: a program the live clocksched- plane names (read here, FULL prefix, never bare) has clock=1 and first_surface=clock T7 neg-control: a fabricated name has no row T8 anti-vacuity of the 2-hop rule: at least one row is credited fork:<caller> AND that caller's own row is on a surface; at least one row is ref:<caller> AND that caller's own row is NOT on a surface (both directions present in the real population, so the rule demonstrably discriminates) T9 every clock-credited row's name really appears in the plane (no credit without a plane token) T10 plan expansion (2026-09-17): the first live clock row that runs nx_plan_run.elf <id> names a plan whose first tool has a census row on a surface (first_surface plan, or a direct surface); the pre-change census is the planted known-bad: it reads that tool REGISTERED-DARK and this tooth goes RED against it T11 a "../<x>.elf literal credits a fork (the regen-forked gapmap) T12 EVERY ROSTER CONF (2026-09-18): every gate row of every conf a live clock row runs through nx_gate_roster_run beat, whatever journal that beat writes, that has a census row reads roster=1. The confs and rows are re-derived HERE by an independent reading (the runner's grammar written again, never the organ's lib), so the organ cannot vouch for itself. T13 the other rosters: the same over the confs OTHER than the runner's default (the heavy and the slow rosters). The pre-change census is the planted known-bad: it read one conf by name, so those gates read roster=0 and T13 goes RED. T14/T15 two methods, one answer: the organ's receipt counts the same beats, and the same beats writing ANOTHER journal (credited too: the close ruler reads each of them from its own journal), as the gate's own reading of the plane. license_tier: ORIGINAL expect_exit: 0 GREEN | 1 RED | 3 SKIP