nx_iot_ctl_gate.nx

nx_iot_ctl_gate.nx -- gate for the sovereign home-electronics organ. Every tooth is designed to FAIL if the claim is false, not to co-sign it: T1 manifest defaults load, and ORDER IS PRECEDENCE (kasa:9999 outranks http:80) -- the exact inversion that makes the live survey call a smart plug a "web-device" T2 conf parsing is real: a conf image REPLACES the defaults, with the parsed values readable back (not merely "a file was opened") T3 fail-safe: a MALFORMED / absent conf degrades to defaults, never to an empty manifest (an organ that silently sees nothing is worse than one that sees the default set) T4 the UDP blind spot is DECLARED: wiz/38899 is present in the manifest, marked udp, and excluded from the swept set T5 NEVER-BRICK: no write verb exists; on/off/set/flash/provision/gcode all resolve to BAD, and the verb map has exactly 4 read-only entries T6 REAL loopback sweep: a live listener on 127.0.0.1 is found through the SHARED lscan_sweep primitive (the same bytes nx_printer_ctl runs) T7 REAL end-to-end classification: a fork'd fake Kasa device on loopback is swept, and the emitted JSON says smart-plug + kasa -- NOT web-device T8 REAL Kasa probe roundtrip: framed+autokey-encrypted get_sysinfo over the kernel TCP stack, reply decrypted, vendor decided by REPLY signal T9 NEGATIVE CONTROL for T7/T8: an HTTP-only listener must NOT be called a kasa plug (a classifier that says "kasa" to everything passes T7) license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0