nx_probe_castmut_live.nx

nx_probe_castmut_live.nx -- RESIDUE EXPERIMENT (2026-08-05, climb v4 rung 1): does `b as i64` in argument position MUTATE the local's recorded type? CONTROL (proven, nx_probe_ptrint_live.nx): pi_int2(b) with NO prior cast REFUSES (`arg 1 is a POINTER but the parameter is an INTEGER`). EXPERIMENT: the same pointer-into-int call placed AFTER pk_int(b as i64). If THIS FILE BUILDS, the refusal vanished => the cast rewrote b's Value type to INTEGER in place, and the sys_munmap arg-1 residue (57/70) is EXPLAINED: the corpus pattern is __syscall(..., req as i64, ...) followed by sys_munmap(req) -- req reads as INTEGER at the later call. If it REFUSES, hypothesis dead. license_tier: ORIGINAL expect_exit: 0