nx_mirrorintegrity_gate.nx

nx_mirrorintegrity_gate.nx -- teeth for the mirror-completeness census. IN-PROCESS BY CONSTRUCTION: it imports nx_mirrorintegrity_lib.nx and calls mi_classify directly, so it exercises THE SAME CODE the census runs instead of parsing the census's stdout. That also means it has no NOT-DEPLOYED failure mode -- a gate that forks a deployed elf reports INCONCLUSIVE when the subject is merely un-promoted, which reads as the gate's fault. EVERY FIXTURE IS ASSEMBLED AT RUNTIME UNDER /tmp/mirrorintegrity_gate/ -- never checked in, never shared with a production beat. A gate that shares its fixture with a beat reports on the fixture, not the code. Setup unlinks before it creates, so a crashed previous run cannot make this one pass or fail differently: A GATE THAT IS NOT IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER. THE FIRST TOOTH IS THE ANTI-VACUITY ONE. The trivial wrong implementation of this census is "flag everything", which would pass every detection tooth below. Only the positive controls -- complete bodies that must NOT be flagged -- can refute it. A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. license_tier: ORIGINAL expect_exit: 0