nx_http_probe_gate.nx

nx_http_probe_gate.nx -- THE REFEREE FOR nx_http_probe. Hermetic, in-process, no external service. WHAT IT HAS TO PROVE, AND WHY THE OBVIOUS GATE WOULD NOT PROVE IT. The organ under test replaces a cron one-liner whose ONLY defect was that it failed SILENTLY: the row fired, the command did not run, all output was discarded, and the capability-plane watch went stale at 10.9x its budget with nobody able to name which link broke. A gate that only asks "does a healthy endpoint return 0" would pass a probe that ALSO returns 0 for a dead one, and a gate that only reads exit codes would pass a probe that stamps the heartbeat on a FAILING run -- which is the same blindness wearing a green badge. So every failure fixture asserts TWO things: the NAMED exit code, and THE ABSENCE OF THE HEARTBEAT. **** THE STAMP IS THE THING THE WATCHER BELIEVES. ASSERTING ITS ABSENCE IS THE TOOTH. **** THE POSITIVE CONTROL IS NOT DECORATION. A guard that refuses everything passes every negative test, and four SSRF deny-tests once went green over a wholly broken guard for exactly that reason. T1-T4 are the input that MUST be accepted, so an always-fail probe cannot score. THE ABSENCE FIXTURES REUSE THE PATH THE POSITIVE CONTROL JUST WROTE. A fixture that asserts "no file appeared at some path" is vacuous if nothing could ever have appeared there. T1/T2 prove this organ writes THIS EXACT PATH; the failing runs then unlink it and prove it stays gone. FIXTURES ARE ASSEMBLED AT RUNTIME, NOT WRITTEN AS LITERALS. A source-scanning detector finds its own fixture, and the estate has paid for that twice. The JSON marker is built from a quote byte, so the needle and the body it lives in come from ONE code path and cannot drift apart. SCRATCH LIVES IN /tmp/nx_http_probe_gate/, NEVER the production tree: a gate that shares a fixture with a production beat reports on the FIXTURE, not on the code (nx_gate_fixture_ratchet_gate). Setup creates and clears; there is no teardown, because a teardown does not run when a run crashes. PORTS ARE PROVEN FREE BY BINDING THEM, NEVER ASSUMED. A probe port you did not verify free is not a control, it is a second instance. If any port is taken the gate SKIPs -- "I could not look" is not "it is broken". expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).