nx_idemp.nx

nx_idemp.nx -- IS THIS GATE IDEMPOTENT? RUN IT TWICE AND COMPARE. No heuristic, no grep. WHY. Rule 10 says every operation must be safe to run twice, and the estate has been paying for the gates that are not -- three confirmed the same day (debt 1786128761): nx_segstore_uncap_gate 7/9 RED from a stale seg-2106 fixture its header told the RUNNER to clean. nx_law_warden T15 25/26 RED for hours, filed sev-7 as a broken per-plane counter. The counter was always right; /tmp/lwseg held zzlw-seg-2 and zzlw-seg-3 from an older revision of the fixture, so segamp correctly said max=4 and the assertion demanded 2. A capability guarding an OOM class sat indicted by its leftovers. nx_coa_gate THE MONEY PATH -- intermittent, with the FAILING TOOTH MOVING between runs, until 2026-07-31 root-caused as C6 registering a side in a PERSISTENT plane so C5 passed only on a virgin store. ★★★★★★A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER. ★★★★★★AN INTERMITTENT FAILURE WHOSE FAILING TOOTH MOVES IS A FIXTURE DEFECT, NOT A RACE -- A RACE USUALLY BREAKS THE SAME ASSERTION. That one distinction would have saved each of the three. WHY MEASURE INSTEAD OF SCAN. The obvious approach is to grep the 140 measured `sys_mkdir("/tmp/...")` sites for a matching cleanup. That is a PROXY: it asks whether the author wrote a pattern, not whether the gate survives a second run. It cannot see a fixture poisoned through a persistent seg-store plane (exactly nx_coa_gate's defect, where no /tmp cleanup would have helped), and it calls a gate SAFE for having an unlink list that is merely incomplete. ★★★★★★RUNNING IT TWICE IS NOT A BETTER HEURISTIC, IT IS THE DEFINITION. Ask the property directly. WHAT IT REPORTS, and the verdict IS the decision: IDEMPOTENT -- run 1 and run 2 agree on exit code AND on the passed/total tally. NON-IDEMPOTENT -- they disagree. The FIRST run's answer is the one everyone has been trusting. UNMEASURED -- the gate could not be executed twice (absent, timeout, spawn failure). NEVER folded into IDEMPOTENT: an unrunnable gate is not a clean one. ⚠DECLARED ENVELOPE, so nobody reads more into a green than it carries: - Two runs prove non-idempotency when they DISAGREE. Agreement is evidence, not proof: a gate whose fixture only poisons on the third run reads clean here. ★TWO RUNS FALSIFY; THEY DO NOT CERTIFY. Use `-n` to raise the run count when a gate is suspected and cheap. - It runs REAL gates with REAL side effects. That is the point -- the second run is the measurement -- but it means this must never be pointed at anything that mutates production beyond its fixture. The roster is verifiers only, matching /api/gate_run's own bound. usage: nx_idemp <gate-elf-path> [runs] default 2 runs license_tier: ORIGINAL Executes verifiers, writes nothing of its own. No hw writes (Rule 26).