nx_nxa_secdump_gate.nx

nx_nxa_secdump_gate.nx -- THE GATE FOR THE NXA SECTION INSPECTOR. SUBJECT: the nx_nxa_secdump ELF, forked for real against NXA containers this gate BUILDS AT RUNTIME under /tmp/nx_nxa_secdump_gate/. Nothing here reads a production asset, so the gate cannot report on a fixture it shares with a beat (the gate-fixture law), and it cannot be silently re-baselined by someone re-baking ref9d. WHY EACH TOOTH EXISTS. The organ's whole value is that its NEGATIVE answers are trustworthy: a reader that says MATCH on a corrupt section, or OK on a container it could not parse, is worse than no reader at all -- it would launder a broken asset as verified. So every refusal path is bitten with a fixture built to trigger exactly that path, and the good fixture is carried alongside as the positive control, because A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. The fixtures are constructed with nxa_check2 -- the format's ONE checksum definition, the same one the subject uses -- so the gate cannot drift from the organ by re-implementing the rule it is testing. That is deliberate and it is a REAL limitation, stated rather than hidden: this gate proves the reader agrees with the format library, not that the format library is right. The checksum itself is nx_nxa's to prove. nx_nxa_secdump_gate [subject_elf] license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0